Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat Linux: libpng Image Processing Flaw Allows Remote Code Execution

published 5 months ago

Summary

The libpng library in Red Hat Linux systems has a security flaw that could allow hackers to execute malicious code on your system remotely. This could lead to unauthorized access and data theft. Update your system to the latest version of libpng to fix this issue.

What to do

Update redhat libpng to version 2:1.6.37-12.el9_0.3.
Update redhat libpng-devel to version 2:1.6.37-12.el9_0.3.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_e4s:9.0::appstream	redhat	libpng	< 2:1.6.37-12.el9_0.3 Fix: upgrade to 2:1.6.37-12.el9_0.3
Red Hat:rhel_e4s:9.0::appstream	redhat	libpng-devel	< 2:1.6.37-12.el9_0.3 Fix: upgrade to 2:1.6.37-12.el9_0.3
Red Hat:rhel_e4s:9.0::baseos	redhat	libpng	< 2:1.6.37-12.el9_0.3 Fix: upgrade to 2:1.6.37-12.el9_0.3
Red Hat:rhel_e4s:9.0::baseos	redhat	libpng-devel	< 2:1.6.37-12.el9_0.3 Fix: upgrade to 2:1.6.37-12.el9_0.3

Original advisory text

Red Hat Security Advisory: libpng security update

References

https://access.redhat.com/errata/RHSA-2026:17685 Vendor Advisory
https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2451819 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_17685.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-33636 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-33636 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33636 Vendor Advisory
https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb408... Third Party Advisory
https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339... Third Party Advisory
https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.6 High

Timeline

Published15 May 2026

Updated15 May 2026

First seen15 May 2026

Sources

RHSA-2026:17685 · OSV

Track software like this

Free during beta