PT-2026-31620

Name of the Vulnerable Software and Affected Versions LIBPNG versions 1.0.9 through 1.6.56 Description LIBPNG is a library used by applications to read, create, and manipulate PNG image files. A flaw exists where passing a pointer obtained from png get PLTE, png get tRNS, or png get hIST back int...

libpng: LIBPNG heap buffer overflow

A buffer overflow flaw has been discovered in libpng. There is a heap buffer overflow vulnerability in the libpng simplified API function pngimagefinishread when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated...

ROS-20260401-73-0026

A vulnerability in the pngsetquantize function of the libpng PNG raster graphics library is related to a buffer overflow in dynamic memory. Exploitation of the vulnerability could allow a remote attacker to execute arbitrary code using a specially generated PNG file...

ROS-20260401-73-0025

A vulnerability in the pngsetquantize function of the libpng PNG raster graphics library is related to a buffer overflow in dynamic memory. Exploitation of the vulnerability could allow a remote attacker to execute arbitrary code using a specially generated PNG file...

ROS-20260401-73-0013

A vulnerability in the pngimagefinishread function of the pngimagefinishread library for handling bitmap graphics in the PNG libpng format is related to writing beyond buffer boundaries in memory. Exploitation of the vulnerability could allow an attacker to execute arbitrary code by loading a...

ROS-20260401-73-0017

A vulnerability in the pngdoquantize function of the pngrtran.c component of the PNG Libpng bitmap graphics library is related to reading outside the allowed data buffer boundaries. Exploitation of the vulnerability may allow an attacker to gain access to confidential data and cause a denial of...

ROS-20260401-73-0021

A vulnerability in the PNG raster graphics library Libpng is related to reading outside of the allowed data buffer boundaries. Exploitation of the vulnerability could allow an attacker to gain access to sensitive data and cause a denial of service...

LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`

...

CVE-2026-33636

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit...

CVE-2026-33636

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit...

CVE-2026-33416

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. In versions 1.2.1 through 1.6.55, pngsettRNS and pngsetPLTE each alias a heap-allocated buffer between pngstruct and pnginfo, sharing a single allocation acros...

CVE-2026-33416

CVE-2026-33416 concerns libpng: in versions 1.2.1 through 1.6.55, png_set_tRNS and png_set_PLTE alias a 256-byte and a 768-byte heap buffer between png_struct and png_info, respectively. Freeing via PNG_FREE_TRNS/PNG_FREE_PLTE frees through info_ptr while png_ptr remains dangling, causing potenti...

SUSE CVE-2026-33416

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. In versions 1.2.1 through 1.6.55, pngsettRNS and pngsetPLTE each alias a heap-allocated buffer between pngstruct and pnginfo, sharing a single allocation acros...

JLSEC-2026-11 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG...

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the pngsetquantize API function. When the function is called with no histogram and the number of...

SUSE-SU-2026:0938-1 Security update for GraphicsMagick

This update for GraphicsMagick fixes the following issues: - CVE-2026-28691: missing check in the JBIG decoder can lead to an uninitialized pointer dereference bsc1259455. - CVE-2026-30883: missing bounds check when encoding a PNG image can lead to a heap buffer over-write bsc1259467...

libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read

A flaw was found in libpng, a reference library for processing PNG Portable Network Graphics image files. A local attacker could exploit a heap buffer over-read vulnerability in the pngimagefinishread function by tricking a user into processing a specially crafted interlaced 16-bit PNG file with ...

libpng: LIBPNG has a heap buffer overflow in png_set_quantize

A heap based buffer overflow flaw has been discovered in LibPNG. Prior to version 1.6.55, an out-of-bounds read vulnerability exists in the pngsetquantize API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported b...

The vulnerability of the library for working with raster graphics in PNG format, Libpng. This vulnerability arises from reading data beyond the permissible buffer limit, allowing attackers to access confidential data and cause service failures.

The vulnerability of the library for working with PNG bitmap graphics involves reading data beyond the allowed buffer limits. Exploiting this vulnerability can allow an attacker to gain access to confidential data, as well as cause service interruptions...

The vulnerability of the library for working with PNG bitmap graphics, related to reading data beyond the buffer’s acceptable limits, allows attackers to access confidential data and cause service failures.

The vulnerability of the library for working with PNG bitmap graphics involves reading data beyond the allowed buffer limits. Exploiting this vulnerability can allow attackers to access confidential data and also cause service failures...

libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read

A flaw was found in libpng, a reference library for processing PNG Portable Network Graphics image files. A local attacker could exploit a heap buffer over-read vulnerability in the pngimagefinishread function by tricking a user into processing a specially crafted interlaced 16-bit PNG file with ...