Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
fltk 1.3.8-1 can be tricked by PNG to crash
published 7 months ago
Summary
The fltk package uses a graphics library that has a mistake when handling specially crafted PNG image files. An attacker could supply a malicious PNG that makes the program read or write outside its memory, potentially causing a crash or allowing the attacker to run code. Update fltk (or the underlying graphics library) to the latest version that includes the fix, or apply any vendor‑provided patches as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | fltk | <= 1.3.8-1 |
Original advisory text
CVE-2026-33636 affecting package fltk 1.3.8-1
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without verifying that enough input pixels remain. Because the implementation works backward from the end of the row, the final iteration dereferences pointers before the start of the row buffer (OOB read) and writes expanded pixel data to the same underflowed positions (OOB write). This is reachable via normal decoding of attacker-controlled PNG input if Neon is enabled. Version 1.6.56 fixes the issue.
References
Timeline
Published26 Mar 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-81312 · OSV
Track software like this
Free during beta