Use-after-free in libpng - CVE-2026-34757

Vulnerability identifier: #VU125602

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-34757

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose heap information and corrupt chunk data.

The vulnerability exists due to use-after-free in png_set_PLTE, png_set_tRNS, and png_set_hIST when passing a pointer returned by the corresponding getter back into the setter on the same png_struct/png_info pair. A remote attacker can pass an aliased pointer to cause the library to read freed memory and copy stale or unrelated heap contents into replacement storage to disclose heap information and corrupt chunk data.

The issue cannot be triggered by a crafted PNG file alone; exploitation requires the application to call the getter and setter in sequence on the same struct pair, and any image containing the relevant chunk is sufficient to set up the internal pointer.

libpng
SUSE Linux Enterprise Server 12 SP5
Debian Linux
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
SUSE Linux Micro
Ubuntu
Basesystem Module
openSUSE Leap
openEuler
Anolis OS
LANTIME Operating System Firmware (LTOS)
libpng (Ubuntu package)
libpng12-0-32bit
libpng12-0-debuginfo-32bit
libpng12-debugsource
libpng12-0-debuginfo
libpng12-compat-devel
libpng12-devel
libpng12-0
libpng15-15-debuginfo
libpng15-debugsource
libpng15-15
libpng16-compat-devel
libpng16-16-debuginfo
libpng16-debugsource
libpng16-16-debuginfo-32bit
libpng16-16-32bit
libpng16-16
libpng16-devel
libpng1.6 (Ubuntu package)
libpng
libpng-help
libpng-devel
libpng-debugsource
libpng-debuginfo
libpng1.6 (Debian package)
libpng-doc
libpng-tools
libpng-static
libpng16-tools-debuginfo
libpng16-tools
libpng16-16-32bit-debuginfo
libpng16-devel-32bit
libpng16-compat-devel-32bit
libpng16-compat-devel-64bit
libpng16-16-64bit
libpng16-16-64bit-debuginfo
libpng16-devel-64bit

Install security update from vendor's website.

libpng - update to 1.6.57
LANTIME Operating System Firmware (LTOS) - update to 7.10.012
libpng (Ubuntu package) - addressed in versions 1.2.50-1ubuntu2.14.04.3+esm2, 1.2.54-1ubuntu1.1+esm3, 1.6.20-2ubuntu0.1~esm4, 1.6.34-1ubuntu0.18.04.2+esm3, 1.6.37-2ubuntu0.1~esm3, 1.6.37-3ubuntu0.6
libpng12-0-32bit - update to 1.2.59-20.14.1
libpng12-0-debuginfo-32bit - update to 1.2.59-20.14.1
libpng12-debugsource - addressed in versions 1.2.59-20.14.1, 1.2.59-150000.4.11.1
libpng12-0-debuginfo - addressed in versions 1.2.59-20.14.1, 1.2.59-150000.4.11.1
libpng12-compat-devel - update to 1.2.59-20.14.1
libpng12-devel - addressed in versions 1.2.59-20.14.1, 1.2.59-150000.4.11.1
libpng12-0 - addressed in versions 1.2.59-20.14.1, 1.2.59-150000.4.11.1
libpng15-15-debuginfo - update to 1.5.22-10.10.1
libpng15-debugsource - update to 1.5.22-10.10.1
libpng15-15 - update to 1.5.22-10.10.1
libpng16-compat-devel - addressed in versions 1.6.8-15.24.1, 1.6.40-150600.3.20.1
libpng16-16-debuginfo - addressed in versions 1.6.8-15.24.1, 1.6.34-150000.3.25.1, 1.6.40-150600.3.20.1, 1.6.44-160000.7.1, 1.6.58-1.1
libpng16-debugsource - addressed in versions 1.6.8-15.24.1, 1.6.34-150000.3.25.1, 1.6.40-150600.3.20.1, 1.6.44-160000.7.1, 1.6.58-1.1
libpng16-16-debuginfo-32bit - update to 1.6.8-15.24.1
libpng16-16-32bit - addressed in versions 1.6.8-15.24.1, 1.6.40-150600.3.20.1
libpng16-16 - addressed in versions 1.6.8-15.24.1, 1.6.34-150000.3.25.1, 1.6.40-150600.3.20.1, 1.6.44-160000.7.1, 1.6.58-1.1
libpng16-devel - addressed in versions 1.6.8-15.24.1, 1.6.40-150600.3.20.1
libpng1.6 (Ubuntu package) - addressed in versions 1.6.37-3ubuntu0.5, 1.6.43-5ubuntu0.6, 1.6.50-1ubuntu0.5
libpng - update to 1.6.37-8
libpng-help - update to 1.6.37-8
libpng-devel - update to 1.6.37-8
libpng-debugsource - update to 1.6.37-8
libpng-debuginfo - update to 1.6.37-8
libpng1.6 (Debian package) - addressed in versions 1.6.39-2+deb12u5, 1.6.48-1+deb13u5
libpng-doc - update to 1.6.40-7
libpng-tools - update to 1.6.40-7
libpng-static - update to 1.6.40-7
libpng-devel - update to 1.6.40-7
libpng - update to 1.6.40-7
libpng16-tools-debuginfo - update to 1.6.40-150600.3.20.1
libpng16-tools - update to 1.6.40-150600.3.20.1
libpng16-16-32bit-debuginfo - update to 1.6.40-150600.3.20.1
libpng16-devel-32bit - update to 1.6.40-150600.3.20.1
libpng16-compat-devel-32bit - update to 1.6.40-150600.3.20.1
libpng16-compat-devel-64bit - update to 1.6.40-150600.3.20.1
libpng16-16-64bit - update to 1.6.40-150600.3.20.1
libpng16-16-64bit-debuginfo - update to 1.6.40-150600.3.20.1
libpng16-devel-64bit - update to 1.6.40-150600.3.20.1

• https://github.com/pnggroup/libpng/security/advisories/GHSA-6fr7-g8h7-v645
• https://github.com/advisories/GHSA-6fr7-g8h7-v645

• Use-after-free in libpng
• SUSE update for libpng15
• SUSE update for libpng16
• SUSE update for libpng16
• SUSE update for libpng16
• Anolis OS update for libpng
• openEuler update for libpng
• SUSE update for libpng12
• SUSE update for libpng12
• Ubuntu update for libpng1.6
• Debian update for libpng1.6
• SUSE update for libpng16
• SUSE update for libpng16
• Ubuntu update for libpng
• Multiple vulnerabilities in Meinberg LANTIME Operating System Firmware