Critical Security Update for libpng: Addressing Arbitrary Code Execution and Information Disclosure
Summary
ALSA-2026:28255: Moderate: libpng security update. Affects libpng versions < 2:1.6.37-15.el9_8.2. Fixed in 2:1.6.37-15.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpng is a widely used library that provides functions for creating and manipulating Portable Network Graphics (PNG) image files. It is an essential component in many applications that require image processing. The library supports various features such as transparency, interlacing, and color management, making it a versatile tool for developers. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this library.
Vulnerability Detail
The vulnerabilities in libpng stem from a use-after-free condition that can lead to arbitrary code execution (CVE-2026-33416) and an out-of-bounds read/write issue during Neon palette expansion, which can result in information disclosure and denial of service (CVE-2026-33636). These vulnerabilities arise from improper memory management and inadequate bounds checking, posing significant risks to applications that utilize the library.
How To Fix
Minimum fixed version
2:1.6.37-15.el9_8.2
This is the first release that contains the fix.
sudo dnf update libpngTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the package is not immediately feasible, consider disabling features that utilize the affected functionalities of libpng until the update can be applied. This may involve modifying your application's image processing capabilities to avoid reliance on the vulnerable library functions.
Conclusion
The identified vulnerabilities in libpng pose significant security risks that can affect applications relying on this library. It is crucial to update to the patched version to mitigate these risks effectively. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert, which can provide real-time alerts based on manifest files.
See every vulnerability recorded for libpng →
FAQ
libpng is a library used for handling PNG image files, providing essential functions for image creation and manipulation.
The vulnerabilities can lead to arbitrary code execution, information disclosure, and denial of service, potentially compromising the security of applications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Consider implementing workarounds such as disabling features that rely on the vulnerable functionalities of libpng until you can apply the update.
For detailed information about the vulnerabilities, refer to the CVE pages: CVE-2026-33416 and CVE-2026-33636.
Related vulnerabilities
Recent vulnerabilities recorded for libpng.
