Most recent entries from all

ALSA-2026:18028 — Moderate: libpng security update

Affected: AlmaLinux:9: libpng, AlmaLinux:9: libpng-devel

The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files.

Security Fix(es):

* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-06668

BELL-CVE-2026-33416

Affected: Alpaquita:23: libpng, Alpaquita:25: libpng, Alpaquita:stream: libpng, BellSoft Hardened Containers:23: libpng, BellSoft Hardened Containers:25: libpng, BellSoft Hardened Containers:stream: libpng

certfr-2026-avi-0381 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoqu…

certfr-2026-avi-0381

CLEANSTART-2026-EK14398 — Security fix for CVE-2026-33416 applied in: libpng 1.6.55-r0

Affected: CleanStart: libpng

Security vulnerability affects the libpng package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-278382

fkie_cve-2026-33416

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE` each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng 1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS` sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr` pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes the issue.

msrc_CVE-2026-33416 — LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`

msrc_CVE-2026-33416

OESA-2026-1852 — libpng security update

Affected: openEuler:24.03-LTS-SP2: libpng, openEuler:24.03-LTS-SP3: libpng, openEuler:20.03-LTS-SP4: libpng, openEuler:22.03-LTS-SP4: libpng, openEuler:24.03-LTS: libpng, openEuler:24.03-LTS-SP1: libpng

The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems. Security Fix(es):

LIBPNG is a reference library for use i…

openSUSE-SU-2026:10451-1 — libpng16-16-1.6.56-1.1 on GA media

libpng16-16-1.6.56-1.1 on GA media

RHSA-2026:11805 — Red Hat Security Advisory: firefox security update

thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 libpng: libpng: Arbitrary code execution due to use-after-free vulnerability libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion

RLSA-2026:26347 — Moderate: libpng15 security update

Affected: Rocky Linux:8: libpng15

The libpng15 package provides libpng 1.5, an older version of the libpng. library for manipulating PNG (Portable Network Graphics) image format files. This version should be used only if you are unable to use the current version of libpng.

Security Fix(es):

* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:1311-1 — Security update for libpng16

Security update for libpng16

UBUNTU-CVE-2026-33416

Affected: Ubuntu:Pro:14.04:LTS: libpng, Ubuntu:Pro:16.04:LTS: libpng, Ubuntu:Pro:16.04:LTS: libpng1.6, Ubuntu:Pro:18.04:LTS: libpng1.6, Ubuntu:Pro:20.04:LTS: libpng1.6, Ubuntu:22.04:LTS: libpng1.6, Ubuntu:24.04:LTS: libpng1.6, Ubuntu:25.10: libpng1.6

VDE-2026-053 — METTLER TOLEDO: EVA Karl Fischer titrators affected by libpng vulnerabilities

Titration software versions prior to 2.0.2.6 are affected by libpng vulnerabilities CVE-2026-33416 and CVE-2026-33636.

WID-SEC-W-2026-0870 — libpng: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in libpng ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service zu verursachen.