Most recent entries from all

ALSA-2026:14790 — Moderate: libpng security update

Affected: AlmaLinux:10: libpng, AlmaLinux:10: libpng-devel

The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files.

Security Fix(es):

* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-06669

BELL-CVE-2026-33636

Affected: Alpaquita:23: libpng, Alpaquita:25: libpng, Alpaquita:stream: libpng, BellSoft Hardened Containers:23: libpng, BellSoft Hardened Containers:25: libpng, BellSoft Hardened Containers:stream: libpng

certfr-2026-avi-0381 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoqu…

certfr-2026-avi-0381

Withdrawn: CLEANSTART-2026-JK26619 — Security fixes in libpng 1.6.55-r0

Withdrawn by the publisher.

Affected: CleanStart: libpng

Package libpng version 1.6.55-r0 fixes 2 vulnerabilities: CVE-2026-33636, CVE-2026-33416

EUVD-2026-277657

fkie_cve-2026-33636

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without verifying that enough input pixels remain. Because the implementation works backward from the end of the row, the final iteration dereferences pointers before the start of the row buffer (OOB read) and writes expanded pixel data to the same underflowed positions (OOB write). This is reachable via normal decoding of attacker-controlled PNG input if Neon is enabled. Version 1.6.56 fixes the issue.

msrc_CVE-2026-33636 — LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64

msrc_CVE-2026-33636

OESA-2026-1852 — libpng security update

Affected: openEuler:24.03-LTS-SP2: libpng, openEuler:24.03-LTS-SP3: libpng, openEuler:20.03-LTS-SP4: libpng, openEuler:22.03-LTS-SP4: libpng, openEuler:24.03-LTS: libpng, openEuler:24.03-LTS-SP1: libpng

The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems. Security Fix(es):

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE` each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng 1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS` sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr` pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes the issue.(CVE-2026-33416)

LIBPNG is a reference library for use i…

openSUSE-SU-2026:10451-1 — libpng16-16-1.6.56-1.1 on GA media

libpng16-16-1.6.56-1.1 on GA media

RHSA-2026:11805 — Red Hat Security Advisory: firefox security update

thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 libpng: libpng: Arbitrary code execution due to use-after-free vulnerability libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion

RLSA-2026:28233 — Moderate: libpng security update

Affected: Rocky Linux:10: libpng

The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files.

Security Fix(es):

* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:21000-1 — Security update for libpng16

Security update for libpng16

UBUNTU-CVE-2026-33636

Affected: Ubuntu:Pro:20.04:LTS: libpng1.6, Ubuntu:22.04:LTS: libpng1.6, Ubuntu:24.04:LTS: libpng1.6, Ubuntu:25.10: libpng1.6

VDE-2026-053 — METTLER TOLEDO: EVA Karl Fischer titrators affected by libpng vulnerabilities

Titration software versions prior to 2.0.2.6 are affected by libpng vulnerabilities CVE-2026-33416 and CVE-2026-33636.

WID-SEC-W-2026-0870 — libpng: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in libpng ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service zu verursachen.