CVE-2026-33416
HighCVSS 7.5Summary
In libpng versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE` each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across two structs with independent lifetimes. Calling `png_free_data` (with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr` pointer remains dangling, and subsequent row-transform functions dereference and in some code paths write to the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect because both functions internally call `png_free_data` before reallocating the `info_ptr` buffer. Version 1.6.56 fixes the issue.
Risk Assessment
The use-after-free vulnerability can lead to memory corruption, application crashes, or potentially arbitrary code execution in the context of a process handling malicious PNG images. The risk affects all applications using libpng to process untrusted images.
Recommendation
Update libpng to version 1.6.56 or later. For applications processing untrusted images, consider additional isolation mechanisms (sandboxing) until the update is deployed.
Other vulnerabilities in libpng
See all- CVE-2026-58936Unknown
In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed.
- CVE-2026-33636High
In libpng versions 1.6.36 through 1.6.55, the ARM/AArch64 Neon-optimized palette expansion path has an out-of-bounds read and write. When expanding the final partial chunk of an 8-bit paletted row, pointers are dereferenced before the row buffer start and expanded data is written out of bounds, reachable via decoding attacker-controlled PNG input when Neon is enabled. Version 1.6.56 fixes the issue.
- CVE-2016-10087High
The png_set_text_2 function in libpng before versions 1.0.67, 1.2.57, 1.4.20, 1.5.28, and 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference. This issue occurs when loading a text chunk into a png structure, removing the text, and then adding another text chunk.
- CVE-2016-3751High
Unspecified vulnerability in libpng before version 1.6.20, used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before July 1, 2016, allows attackers to gain privileges via a crafted application.
- CVE-2015-8540High
An integer underflow in the png_check_keyword function in pngwutil.c in libpng allows remote attackers to trigger an out-of-bounds read by using a space character as a keyword in a PNG image.
- CVE-2015-8472High
Buffer overflow in the png_set_PLTE function in libpng before version 1.0.65 and in versions 1.1.x, 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause application crashes or possibly have unspecified other impacts via a small bit-depth value in an IHDR (image header) chunk in a PNG image.
- CVE-2015-0973High
Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent attackers to execute arbitrary code via IDAT data with a large width.
- CVE-2014-9495High
Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16 may allow context-dependent attackers to execute arbitrary code via a 'very wide interlaced' PNG image on 64-bit systems.
- CVE-2015-8126High
Multiple buffer overflows in the png_set_PLTE and png_get_PLTE functions in libpng before version 1.0.64 and in versions 1.1.x, 1.2.x, 1.3.x, 1.4.x, 1.5.x, and 1.6.x before their respective versions may allow remote attackers to cause application crashes or potentially other unspecified impacts via a small bit-depth value in an IHDR (image header) chunk in a PNG image.
- CVE-2026-40930Medium
LIBPNG version 1.8.0 has a bug in the push-mode APNG parser: three inter-frame chunk discard paths do not consume the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to png_process_data.
Original NVD description (English source)
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE` each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng 1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS` sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr` pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS