Out-of-bounds read in libpng - CVE-2026-33636

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU125600

Out-of-bounds read in libpng - CVE-2026-33636

Published: April 9, 2026


Vulnerability identifier: #VU125600
CSH Severity: Medium
CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33636
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service, disclose sensitive information, and corrupt memory.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in the ARM/AArch64 Neon palette expansion path when decoding a crafted paletted PNG image with palette expansion enabled. A remote attacker can supply a specially crafted PNG image to cause a denial of service, disclose sensitive information, and corrupt memory.

Only builds targeting ARM/AArch64 with Neon enabled are affected. The issue is triggered for palette-based images during palette expansion, with the RGBA path requiring a tRNS chunk and the RGB path requiring no tRNS chunk. User interaction is required to open or process the crafted image.


Affected software

libpng
Debian Linux
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Micro
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Ubuntu
Basesystem Module
openSUSE Leap
openEuler
Fedora
DataStage on Cloud Pak for Data
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libpng (Ubuntu package)
libpng1.6 (Ubuntu package)
libpng (Red Hat package)
libpng1.6 (Debian package)
libpng
libpng-doc
libpng-tools
libpng-static
libpng-devel
libpng-help
libpng-debugsource
libpng-debuginfo
libpng16-tools
libpng16-devel-64bit
libpng16-compat-devel-64bit
libpng16-16-64bit
libpng16-16-64bit-debuginfo
libpng16-16-32bit-debuginfo
libpng16-devel-32bit
libpng16-compat-devel-32bit
libpng16-16-32bit
libpng16-16
libpng16-tools-debuginfo
libpng16-16-debuginfo
libpng16-debugsource
libpng16-devel
libpng16-compat-devel
mingw-libpng
java-25-openjdk (Red Hat package)
firefox (Red Hat package)
thunderbird (Red Hat package)
firefox
thunderbird

How to mitigate CVE-2026-33636

Install security update from vendor's website.

libpng - update to 1.6.56
DataStage on Cloud Pak for Data - addressed in versions 5.3.1 patch 8, 5.4
libpng (Ubuntu package) - addressed in versions 1.2.50-1ubuntu2.14.04.3+esm2, 1.2.54-1ubuntu1.1+esm3, 1.6.20-2ubuntu0.1~esm4, 1.6.34-1ubuntu0.18.04.2+esm3, 1.6.37-2ubuntu0.1~esm3, 1.6.37-3ubuntu0.6
libpng1.6 (Ubuntu package) - addressed in versions 1.6.37-3ubuntu0.5, 1.6.43-5ubuntu0.6, 1.6.50-1ubuntu0.5
libpng (Red Hat package) - addressed in versions 1.6.37-12.el9_0.3, 1.6.37-12.el9_2.3, 1.6.37-12.el9_4.3, 1.6.37-12.el9_6.3, 1.6.37-12.el9_7.3, 1.6.40-8.el10_0.3, 1.6.40-8.el10_1.3
libpng1.6 (Debian package) - addressed in versions 1.6.39-2+deb12u4, 1.6.48-1+deb13u4
libpng - update to 1.6.40-6
libpng-doc - update to 1.6.40-6
libpng-tools - update to 1.6.40-6
libpng-static - update to 1.6.40-6
libpng-devel - update to 1.6.40-6
libpng-help - update to 1.6.40-8
libpng-static - update to 1.6.40-8
libpng-devel - update to 1.6.40-8
libpng-debugsource - update to 1.6.40-8
libpng-debuginfo - update to 1.6.40-8
libpng - update to 1.6.40-8
libpng-tools - update to 1.6.40-8
libpng16-tools - update to 1.6.40-150600.3.17.1
libpng16-devel-64bit - update to 1.6.40-150600.3.17.1
libpng16-compat-devel-64bit - update to 1.6.40-150600.3.17.1
libpng16-16-64bit - update to 1.6.40-150600.3.17.1
libpng16-16-64bit-debuginfo - update to 1.6.40-150600.3.17.1
libpng16-16-32bit-debuginfo - update to 1.6.40-150600.3.17.1
libpng16-devel-32bit - update to 1.6.40-150600.3.17.1
libpng16-compat-devel-32bit - update to 1.6.40-150600.3.17.1
libpng16-16-32bit - update to 1.6.40-150600.3.17.1
libpng16-16 - addressed in versions 1.6.40-150600.3.17.1, 1.6.58-1.1
libpng16-tools-debuginfo - update to 1.6.40-150600.3.17.1
libpng16-16-debuginfo - addressed in versions 1.6.40-150600.3.17.1, 1.6.58-1.1
libpng16-debugsource - addressed in versions 1.6.40-150600.3.17.1, 1.6.58-1.1
libpng16-devel - update to 1.6.40-150600.3.17.1
libpng16-compat-devel - update to 1.6.40-150600.3.17.1
libpng - addressed in versions 1.6.56-1.fc42, 1.6.56-1.fc43, 1.6.56-1.fc44
mingw-libpng - addressed in versions 1.6.56-1.fc42, 1.6.56-1.fc43, 1.6.56-1.fc44
java-25-openjdk (Red Hat package) - addressed in versions 25.0.3.0.9-1.el9, 25.0.3.0.9-1.el10_2
firefox (Red Hat package) - addressed in versions 140.9.1-1.el8_2, 140.9.1-1.el8_4, 140.9.1-1.el8_6, 140.9.1-1.el8_8, 140.9.1-1.el8_10, 140.9.1-1.el9_0, 140.9.1-1.el9_2, 140.9.1-1.el9_4, 140.9.1-1.el9_6, 140.9.1-1.el9_7, 140.9.1-1.el10_0, 140.9.1-1.el10_1, 140.9.1-2.el7_9
thunderbird (Red Hat package) - addressed in versions 140.9.1-1.el8_4, 140.9.1-1.el8_6, 140.9.1-1.el8_8, 140.9.1-1.el8_10, 140.9.1-1.el9_0, 140.9.1-1.el9_2, 140.9.1-1.el9_4, 140.9.1-1.el9_6, 140.9.1-1.el9_7, 140.9.1-1.el10_0, 140.9.1-1.el10_1
firefox - update to 140.9.1-1.0.1
thunderbird - update to 140.12.0-1.0.1

External References

Related Security Bulletins