CVE-2026-34757

Name
CVE-2026-34757
Description
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct). This vulnerability is fixed in 1.6.57.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security-advisories@github.com https://github.com/pnggroup/libpng/commit/398cbe3df03f4e11bb031e07f416dfdde3684e8a
security-advisories@github.com https://github.com/pnggroup/libpng/commit/55d20aaa322c9274491cda82c5cd4f99b48c6bcc
security-advisories@github.com https://github.com/pnggroup/libpng/issues/836
security-advisories@github.com https://github.com/pnggroup/libpng/issues/837
security-advisories@github.com https://github.com/pnggroup/libpng/security/advisories/GHSA-6fr7-g8h7-v645
af854a3a-2127-422b-91ae-364da2661108 https://lists.debian.org/debian-lts-announce/2026/05/msg00017.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:* libpng >= 1.0.9 < 1.6.57

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
libpng edge-main 1.6.57-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
libpng edge-main 1.6.56-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng edge-main 1.6.55-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng edge-main 1.6.54-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng edge-main 1.6.53-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng edge-main 1.6.51-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng edge-main 1.6.51-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng edge-main 1.6.49-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng edge-main 1.6.47-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng edge-main 1.6.46-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng edge-main 1.6.45-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng edge-main 1.6.44-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng edge-main 1.6.37-r0 None possibly vulnerable
libpng 3.23-main 1.6.57-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
libpng 3.23-main 1.6.56-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.23-main 1.6.55-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.23-main 1.6.54-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.23-main 1.6.53-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.22-main 1.6.57-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
libpng 3.22-main 1.6.56-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.22-main 1.6.55-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.22-main 1.6.54-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.22-main 1.6.53-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.22-main 1.6.51-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.22-main 1.6.47-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.22-main 1.6.37-r0 None possibly vulnerable
libpng 3.21-main 1.6.57-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
libpng 3.21-main 1.6.56-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.21-main 1.6.55-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.21-main 1.6.54-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.21-main 1.6.53-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.21-main 1.6.47-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.21-main 1.6.44-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.21-main 1.6.37-r0 None possibly vulnerable
libpng 3.20-main 1.6.57-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
libpng 3.20-main 1.6.56-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.20-main 1.6.55-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.20-main 1.6.54-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.20-main 1.6.53-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.20-main 1.6.44-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.20-main 1.6.37-r0 None possibly vulnerable
libpng 3.19-main 1.6.44-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
libpng 3.19-main 1.6.37-r0 None possibly vulnerable