Out-of-bounds read in libpng - CVE-2026-33636
Published: April 9, 2026
libpng
Detailed vulnerability description
The vulnerability allows a remote attacker to cause a denial of service, disclose sensitive information, and corrupt memory.
The vulnerability exists due to out-of-bounds read and out-of-bounds write in the ARM/AArch64 Neon palette expansion path when decoding a crafted paletted PNG image with palette expansion enabled. A remote attacker can supply a specially crafted PNG image to cause a denial of service, disclose sensitive information, and corrupt memory.
Only builds targeting ARM/AArch64 with Neon enabled are affected. The issue is triggered for palette-based images during palette expansion, with the RGBA path requiring a tRNS chunk and the RGB path requiring no tRNS chunk. User interaction is required to open or process the crafted image.