Skip to content
OpenAdvisories
Medium ALSA-2026:14791 1 CVE

Moderate: libpng security update

Published May 7, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files.

Security Fix(es):

* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 9 libpng 2:1.6.37-12.el9_7.3
AlmaLinux · 9 libpng-devel 2:1.6.37-12.el9_7.3

Vulnerabilities 1

  • High 7.6
    CVE-2026-33636

    LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palett…

    pnggroup libpng fltk libpng1.6 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-33636
  • report
    https://bugzilla.redhat.com/2451819
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-14791.html