Skip to content
OpenAdvisories
High RHSA-2026:14791 1 CVE

Red Hat Security Advisory: libpng security update

Published May 8, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream libpng 2:1.6.37-12.el9_7.3
Red Hat · RHEL 9 enterprise_linux:9::appstream libpng-debuginfo 2:1.6.37-12.el9_7.3
Red Hat · RHEL 9 enterprise_linux:9::appstream libpng-debugsource 2:1.6.37-12.el9_7.3
Red Hat · RHEL 9 enterprise_linux:9::appstream libpng-devel 2:1.6.37-12.el9_7.3
Red Hat · RHEL 9 enterprise_linux:9::appstream libpng-devel-debuginfo 2:1.6.37-12.el9_7.3
Red Hat · RHEL 9 enterprise_linux:9::appstream libpng-tools-debuginfo 2:1.6.37-12.el9_7.3
Red Hat · RHEL 9 enterprise_linux:9::baseos libpng 2:1.6.37-12.el9_7.3
Red Hat · RHEL 9 enterprise_linux:9::baseos libpng-debuginfo 2:1.6.37-12.el9_7.3
Red Hat · RHEL 9 enterprise_linux:9::baseos libpng-debugsource 2:1.6.37-12.el9_7.3
Red Hat · RHEL 9 enterprise_linux:9::baseos libpng-devel-debuginfo 2:1.6.37-12.el9_7.3
Red Hat · RHEL 9 enterprise_linux:9::baseos libpng-tools-debuginfo 2:1.6.37-12.el9_7.3

Vulnerabilities 1

  • High 7.6
    CVE-2026-33636

    LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64

    LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palett…

    pnggroup libpng fltk libpng1.6 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2451819
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_14791.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-33636
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-33636
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-33636
  • article
    https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869
  • article
    https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3
  • article
    https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2