Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Red Hat libpng Security Update: Arbitrary Code Execution
published 5 months ago
Summary
A security issue was found in the libpng library used by various Red Hat products. If exploited, this issue could allow an attacker to execute malicious code on a victim's system. Red Hat has released an update to fix this issue, and it is recommended that users apply the update as soon as possible.
What to do
- Update redhat libpng to version 2:1.6.37-12.el9_4.4.
- Update redhat libpng-debuginfo to version 2:1.6.37-12.el9_4.4.
- Update redhat libpng-debugsource to version 2:1.6.37-12.el9_4.4.
- Update redhat libpng-devel to version 2:1.6.37-12.el9_4.4.
- Update redhat libpng-devel-debuginfo to version 2:1.6.37-12.el9_4.4.
- Update redhat libpng-tools-debuginfo to version 2:1.6.37-12.el9_4.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:rhel_eus:9.4::appstream | redhat | libpng |
< 2:1.6.37-12.el9_4.4 Fix: upgrade to 2:1.6.37-12.el9_4.4
|
| Red Hat:rhel_eus:9.4::appstream | redhat | libpng-debuginfo |
< 2:1.6.37-12.el9_4.4 Fix: upgrade to 2:1.6.37-12.el9_4.4
|
| Red Hat:rhel_eus:9.4::appstream | redhat | libpng-debugsource |
< 2:1.6.37-12.el9_4.4 Fix: upgrade to 2:1.6.37-12.el9_4.4
|
| Red Hat:rhel_eus:9.4::appstream | redhat | libpng-devel |
< 2:1.6.37-12.el9_4.4 Fix: upgrade to 2:1.6.37-12.el9_4.4
|
| Red Hat:rhel_eus:9.4::appstream | redhat | libpng-devel-debuginfo |
< 2:1.6.37-12.el9_4.4 Fix: upgrade to 2:1.6.37-12.el9_4.4
|
| Red Hat:rhel_eus:9.4::appstream | redhat | libpng-tools-debuginfo |
< 2:1.6.37-12.el9_4.4 Fix: upgrade to 2:1.6.37-12.el9_4.4
|
| Red Hat:rhel_eus:9.4::baseos | redhat | libpng |
< 2:1.6.37-12.el9_4.4 Fix: upgrade to 2:1.6.37-12.el9_4.4
|
| Red Hat:rhel_eus:9.4::baseos | redhat | libpng-debuginfo |
< 2:1.6.37-12.el9_4.4 Fix: upgrade to 2:1.6.37-12.el9_4.4
|
| Red Hat:rhel_eus:9.4::baseos | redhat | libpng-debugsource |
< 2:1.6.37-12.el9_4.4 Fix: upgrade to 2:1.6.37-12.el9_4.4
|
| Red Hat:rhel_eus:9.4::baseos | redhat | libpng-devel |
< 2:1.6.37-12.el9_4.4 Fix: upgrade to 2:1.6.37-12.el9_4.4
|
| Red Hat:rhel_eus:9.4::baseos | redhat | libpng-devel-debuginfo |
< 2:1.6.37-12.el9_4.4 Fix: upgrade to 2:1.6.37-12.el9_4.4
|
| Red Hat:rhel_eus:9.4::baseos | redhat | libpng-tools-debuginfo |
< 2:1.6.37-12.el9_4.4 Fix: upgrade to 2:1.6.37-12.el9_4.4
|
Original advisory text
Red Hat Security Advisory: libpng security update
References
- https://access.redhat.com/errata/RHSA-2026:20549 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2451805 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20549.... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-33416 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-33416 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33416 Vendor Advisory
- https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820... Third Party Advisory
- https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d906... Third Party Advisory
- https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a... Third Party Advisory
- https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012e... Third Party Advisory
- https://github.com/pnggroup/libpng/pull/824 Third Party Advisory
- https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published26 May 2026
Updated26 May 2026
First seen26 May 2026
Sources
RHSA-2026:20549 · OSV
Track software like this
Free during beta