Moderate Security Vulnerability in libpng: Information Disclosure and Denial of Service
Summary
RLSA-2026:14790: Moderate: libpng security update. Affects libpng versions < 2:1.6.40-8.el10_1.3. Fixed in 2:1.6.40-8.el10_1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpng is a widely used library for creating and manipulating Portable Network Graphics (PNG) image files. It provides essential functions for handling PNG images, making it a critical component in various applications that require image processing. The library is known for its efficiency and versatility, but it has recently been identified as vulnerable to specific security issues that could lead to significant risks.
Vulnerability Detail
The vulnerability identified as CVE-2026-33636 in libpng allows for information disclosure and denial of service due to out-of-bounds read/write operations during Neon palette expansion. This flaw can be exploited by attackers to manipulate PNG files, potentially leading to unauthorized access to sensitive information or causing applications to crash. The severity of this vulnerability is underscored by its CVSS score of 7.6, indicating a moderate risk level.
How To Fix
Minimum fixed version
2:1.6.40-8.el10_1.3
This is the first release that contains the fix.
sudo dnf update libpngTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted PNG files until the package is updated. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The libpng library has a moderate security vulnerability that could lead to information disclosure and denial of service. It is crucial for users to update to the patched version to mitigate these risks. Temporary workarounds are available, but the best course of action is to apply the update as soon as possible.
See every vulnerability recorded for libpng →
FAQ
CVE-2026-33636 is a security vulnerability in the libpng library that can lead to information disclosure and denial of service due to out-of-bounds read/write operations.
If your application uses libpng to process PNG images, it may be susceptible to crashes or unauthorized data access if the vulnerability is exploited.
If an immediate update is not possible, avoid processing untrusted PNG files to reduce the risk of exploitation.
More details can be found on the CVE page for CVE-2026-33636, which provides insights into the impact and technical aspects of the vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for libpng.
