Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
libpng: Unsecured PNG Images Can Execute Malicious Code
published 4 months ago
Summary
Libpng, a library used to create and manipulate PNG image files, has a security flaw that could allow hackers to run malicious code on your system. This could happen if you open a malicious PNG image. You should update your libpng library to the latest version to fix this issue.
What to do
- Update almalinux libpng to version 2:1.6.37-15.el9_8.2.
- Update almalinux libpng-devel to version 2:1.6.37-15.el9_8.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:9 | almalinux | libpng |
< 2:1.6.37-15.el9_8.2 Fix: upgrade to 2:1.6.37-15.el9_8.2
|
| AlmaLinux:9 | almalinux | libpng-devel |
< 2:1.6.37-15.el9_8.2 Fix: upgrade to 2:1.6.37-15.el9_8.2
|
Original advisory text
Moderate: libpng security update
The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files.
Security Fix(es):
* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:28255 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-33416 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-33636 Third Party Advisory
- https://bugzilla.redhat.com/2451805 Third Party Advisory
- https://bugzilla.redhat.com/2451819 Third Party Advisory
- https://errata.almalinux.org/9/ALSA-2026-28255.html Vendor Advisory
Timeline
Published23 Jun 2026
Updated25 Jun 2026
First seen25 Jun 2026
Sources
ALSA-2026:28255 · OSV
Track software like this
Free during beta