Moderate Vulnerability in libpng: Arbitrary Code Execution and Information Disclosure
Summary
RLSA-2026:28233: Moderate: libpng security update. Affects libpng versions < 2:1.6.40-11.el10_2.1. Fixed in 2:1.6.40-11.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpng is a widely used library for creating and manipulating Portable Network Graphics (PNG) image files. It provides essential functions for handling PNG images, making it a critical component in many applications that require image processing. The library is known for its efficiency and versatility, but it has recently been identified as vulnerable to security issues that could compromise the integrity and confidentiality of applications utilizing it.
Vulnerability Detail
The vulnerabilities in libpng arise from a use-after-free condition and out-of-bounds read/write operations during Neon palette expansion. The use-after-free vulnerability (CVE-2026-33416) can lead to arbitrary code execution, allowing attackers to execute malicious code within the context of the application using the library. Additionally, the out-of-bounds read/write vulnerability (CVE-2026-33636) can result in information disclosure and denial of service, potentially exposing sensitive data or crashing the application. These vulnerabilities are particularly concerning as they can be exploited remotely, affecting a wide range of applications that rely on libpng.
How To Fix
Minimum fixed version
2:1.6.40-11.el10_2.1
This is the first release that contains the fix.
sudo dnf update libpngTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider disabling features that utilize libpng until the package is updated. However, this may not be feasible for all applications and is not a substitute for applying the security update.
Conclusion
The libpng library has been identified with moderate vulnerabilities that could lead to serious security issues, including arbitrary code execution and information disclosure. It is crucial for users to update to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libpng →
FAQ
libpng is a library used for handling PNG image files, providing functions for creating and manipulating images in this format.
The vulnerabilities include a use-after-free condition leading to arbitrary code execution and out-of-bounds read/write operations causing information disclosure and denial of service.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
The CVSS score for this vulnerability is 7.6, indicating a moderate severity level.
You can update libpng by running the command 'sudo yum update libpng' in your terminal, ensuring you have access to the BaseOS repository.
Related vulnerabilities
Recent vulnerabilities recorded for libpng.
