Description
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE` each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng 1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS` sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr` pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pnggroup | libpng | >= 1.2.1, < 1.6.56 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libpng1.6 | 1.6.56-1 | — |
| Debian 13 | libpng1.6 | 1.6.48-1+deb13u4 | DSA-6189-1 |
| Debian 12 | libpng1.6 | 1.6.39-2+deb12u4 | DSA-6189-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | libpng1.6 | 1.6.50-1ubuntu0.5 | — |
| Ubuntu 24.04 LTS | libpng1.6 | 1.6.43-5ubuntu0.6 | — |
| Ubuntu 22.04 LTS | libpng1.6 | 1.6.37-3ubuntu0.5 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | libpng1.6 | 1.6.37-2ubuntu0.1~esm3 | — |
| Ubuntu Pro 18.04 LTS | libpng1.6 | 1.6.34-1ubuntu0.18.04.2+esm3 | — |
| Ubuntu Pro 16.04 LTS | libpng | 1.2.54-1ubuntu1.1+esm3 | — |
| Ubuntu Pro 16.04 LTS | libpng1.6 | 1.6.20-2ubuntu0.1~esm4 | — |
| Ubuntu Pro 14.04 LTS | libpng | 1.2.50-1ubuntu2.14.04.3+esm2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | firefox +1 | 140.9.1-1.el10_1 | RHSA-2026:9638, RHSA-2026:7672 |
| RHEL 10 | java-21-openjdk +22 | 1:21.0.11.0.10-2.el10_2 | RHSA-2026:9689 |
| RHEL 10 | java-25-openjdk +25 | 1:25.0.3.0.9-1.el10_2 | RHSA-2026:9693 |
| RHEL 10 | libpng +1 | 2:1.6.40-8.el10_1.4 | RHSA-2026:28233, RHSA-2026:18064 |
| RHEL 9 | firefox +2 | 140.9.1-1.el9_7 | RHSA-2026:8459, RHSA-2026:7671 |
| RHEL 9 | java-1.8.0-openjdk +16 | 1:1.8.0.492.b09-2.el9 | RHSA-2026:9683 |
| RHEL 9 | java-17-openjdk +22 | 1:17.0.19.0.10-2.el9 | RHSA-2026:9686 |
| RHEL 9 | java-21-openjdk +22 | 1:21.0.11.0.10-2.el9 | RHSA-2026:9689 |
| RHEL 9 | java-25-openjdk +25 | 1:25.0.3.0.9-1.el9 | RHSA-2026:9693 |
| RHEL 9 | libpng +1 | 2:1.6.37-12.el9_7.4 | RHSA-2026:28255, RHSA-2026:18028 |
| RHEL 9 | libpng15 | 1.5.30-15.el9_8.1 | RHSA-2026:28244 |
| RHEL 8 | firefox +1 | 140.9.1-1.el8_10 | RHSA-2026:9345, RHSA-2026:8052 |
| RHEL 8 | java-1.8.0-openjdk +19 | 1:1.8.0.492.b09-1.el8 | RHSA-2026:9683 |
| RHEL 8 | java-17-openjdk +22 | 1:17.0.19.0.10-1.el8 | RHSA-2026:9686 |
| RHEL 8 | java-21-openjdk +22 | 1:21.0.11.0.10-1.el8 | RHSA-2026:9689 |
| RHEL 8 | libpng +1 | 2:1.6.34-11.el8_10 | RHSA-2026:29898 |
| RHEL 8 | libpng12 | 1.2.57-7.el8_10 | RHSA-2026:26348 |
| RHEL 8 | libpng15 | 1.5.30-9.el8_10 | RHSA-2026:26347 |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | firefox +1 | 140.9.1-1.el10_0 | RHSA-2026:13665, RHSA-2026:11813 |
| RHEL 10.0 EUS | java-21-openjdk +22 | 1:21.0.11.0.10-1.el10_2 | RHSA-2026:9689 |
| RHEL 10.0 EUS | libpng +1 | 2:1.6.40-8.el10_0.4 | RHSA-2026:20551 |
| RHEL 9.6 EUS | firefox +2 | 140.9.1-1.el9_6 | RHSA-2026:13583, RHSA-2026:13342 |
| RHEL 9.6 EUS | java-1.8.0-openjdk +16 | 1:1.8.0.492.b09-1.el9 | RHSA-2026:9683 |
| RHEL 9.6 EUS | java-17-openjdk +22 | 1:17.0.19.0.10-1.el9 | RHSA-2026:9686 |
| RHEL 9.6 EUS | java-21-openjdk +22 | 1:21.0.11.0.10-1.el9 | RHSA-2026:9689 |
| RHEL 9.6 EUS | libpng +1 | 2:1.6.37-12.el9_6.4 | RHSA-2026:20548 |
| RHEL 9.6 EUS | libpng15 | 1.5.30-14.el9_6.2 | RHSA-2026:28456 |
| RHEL 9.4 EUS | firefox +2 | 140.9.1-1.el9_4 | RHSA-2026:13582, RHSA-2026:13533 |
| RHEL 9.4 EUS | java-1.8.0-openjdk +16 | 1:1.8.0.492.b09-1.el9 | RHSA-2026:9683 |
| RHEL 9.4 EUS | java-17-openjdk +22 | 1:17.0.19.0.10-1.el9 | RHSA-2026:9686 |
| RHEL 9.4 EUS | java-21-openjdk +22 | 1:21.0.11.0.10-1.el9 | RHSA-2026:9689 |
| RHEL 9.4 EUS | libpng +1 | 2:1.6.37-12.el9_4.4 | RHSA-2026:20549 |
| RHEL 9.4 E4S | libpng15 | 1.5.30-14.el9_4.2 | RHSA-2026:28457 |
| RHEL 9.2 E4S | firefox +2 | 140.9.1-1.el9_2 | RHSA-2026:13922, RHSA-2026:13412 |
| RHEL 9.2 E4S | java-1.8.0-openjdk +6 | 1:1.8.0.492.b09-1.el9 | RHSA-2026:9683 |
| RHEL 9.2 E4S | java-17-openjdk +8 | 1:17.0.19.0.10-1.el9 | RHSA-2026:9686 |
| RHEL 9.2 E4S | libpng +1 | 2:1.6.37-12.el9_2.4 | RHSA-2026:20550 |
| RHEL 9.2 E4S | libpng15 | 1.5.30-14.el9_2.2 | RHSA-2026:28458 |
| RHEL 9.0 E4S | firefox +1 | 140.9.1-1.el9_0 | RHSA-2026:13596, RHSA-2026:12264 |
| RHEL 9.0 E4S | java-1.8.0-openjdk +6 | 1:1.8.0.492.b09-1.el9 | RHSA-2026:9683 |
| RHEL 9.0 E4S | java-17-openjdk +8 | 1:17.0.19.0.10-1.el9 | RHSA-2026:9686 |
| RHEL 8.8 TUS | firefox +1 | 140.9.1-1.el8_8 | RHSA-2026:14223, RHSA-2026:13682 |
| RHEL 8.8 TUS | java-1.8.0-openjdk +7 | 1:1.8.0.492.b09-1.el8 | RHSA-2026:9683 |
| RHEL 8.8 TUS | java-17-openjdk +8 | 1:17.0.19.0.10-1.el8 | RHSA-2026:9686 |
| RHEL 8.8 TUS | libpng +1 | 2:1.6.34-8.el8_8.3 | RHSA-2026:29900 |
| RHEL 8.8 TUS | libpng12 | 1.2.57-5.el8_8.2 | RHSA-2026:29018 |
| RHEL 8.8 TUS | libpng15 | 1.5.30-7.el8_8.2 | RHSA-2026:29016 |
| RHEL 8.8 E4S | firefox +1 | 140.9.1-1.el8_8 | RHSA-2026:14223, RHSA-2026:13682 |
| RHEL 8.8 E4S | java-1.8.0-openjdk +7 | 1:1.8.0.492.b09-1.el8 | RHSA-2026:9683 |
| RHEL 8.8 E4S | java-17-openjdk +8 | 1:17.0.19.0.10-1.el8 | RHSA-2026:9686 |
| RHEL 8.8 E4S | libpng +1 | 2:1.6.34-8.el8_8.3 | RHSA-2026:29900 |
| RHEL 8.8 E4S | libpng12 | 1.2.57-5.el8_8.2 | RHSA-2026:29018 |
| RHEL 8.8 E4S | libpng15 | 1.5.30-7.el8_8.2 | RHSA-2026:29016 |
| RHEL 8.6 TUS | firefox +1 | 140.9.1-1.el8_6 | RHSA-2026:15889, RHSA-2026:13683 |
| RHEL 8.6 TUS | java-1.8.0-openjdk +7 | 1:1.8.0.492.b09-1.el8 | RHSA-2026:9683 |
| RHEL 8.6 TUS | java-17-openjdk +8 | 1:17.0.19.0.10-1.el8 | RHSA-2026:9686 |
| RHEL 8.6 EUS Long Life | libpng +1 | 2:1.6.34-8.el8_6.3 | RHSA-2026:29901 |
| RHEL 8.6 EUS Long Life | libpng12 | 1.2.57-5.el8_6.2 | RHSA-2026:29020 |
| RHEL 8.6 EUS Long Life | libpng15 | 1.5.30-7.el8_6.2 | RHSA-2026:29019 |
| RHEL 8.6 E4S | firefox +1 | 140.9.1-1.el8_6 | RHSA-2026:15889, RHSA-2026:13683 |
| RHEL 8.6 E4S | java-1.8.0-openjdk +7 | 1:1.8.0.492.b09-1.el8 | RHSA-2026:9683 |
| RHEL 8.6 E4S | java-17-openjdk +8 | 1:17.0.19.0.10-1.el8 | RHSA-2026:9686 |
| RHEL 8.6 AUS | firefox +1 | 140.9.1-1.el8_6 | RHSA-2026:15889, RHSA-2026:13683 |
| RHEL 8.6 AUS | java-1.8.0-openjdk +7 | 1:1.8.0.492.b09-1.el8 | RHSA-2026:9683 |
| RHEL 8.6 AUS | java-17-openjdk +8 | 1:17.0.19.0.10-1.el8 | RHSA-2026:9686 |
| RHEL 8.6 AUS | libpng +1 | 2:1.6.34-8.el8_6.3 | RHSA-2026:29901 |
| RHEL 8.6 AUS | libpng12 | 1.2.57-5.el8_6.2 | RHSA-2026:29020 |
| RHEL 8.6 AUS | libpng15 | 1.5.30-7.el8_6.2 | RHSA-2026:29019 |
| RHEL 8.4 EUS Long Life | firefox +1 | 140.9.1-1.el8_4 | RHSA-2026:14303, RHSA-2026:13600 |
| RHEL 8.4 EUS Long Life | java-1.8.0-openjdk +7 | 1:1.8.0.492.b09-1.el8 | RHSA-2026:9683 |
| RHEL 8.4 EUS Long Life | java-17-openjdk +22 | 1:17.0.19.0.10-1.el8 | RHSA-2026:9686 |
| RHEL 8.4 EUS Long Life | libpng +1 | 2:1.6.34-8.el8_4.3 | RHSA-2026:29902 |
| RHEL 8.4 EUS Long Life | libpng12 | 1.2.57-5.el8_4.2 | RHSA-2026:29022 |
| RHEL 8.4 EUS Long Life | libpng15 | 1.5.30-7.el8_4.2 | RHSA-2026:29021 |
| RHEL 8.4 AUS | firefox +1 | 140.9.1-1.el8_4 | RHSA-2026:14303, RHSA-2026:13600 |
| RHEL 8.4 AUS | java-1.8.0-openjdk +7 | 1:1.8.0.492.b09-1.el8 | RHSA-2026:9683 |
| RHEL 8.4 AUS | java-17-openjdk +8 | 1:17.0.19.0.10-1.el8 | RHSA-2026:9686 |
| RHEL 8.4 AUS | libpng +1 | 2:1.6.34-8.el8_4.3 | RHSA-2026:29902 |
| RHEL 8.4 AUS | libpng12 | 1.2.57-5.el8_4.2 | RHSA-2026:29022 |
| RHEL 8.4 AUS | libpng15 | 1.5.30-7.el8_4.2 | RHSA-2026:29021 |
| RHEL 8.2 AUS | firefox | 140.9.1-1.el8_2 | RHSA-2026:11805 |
| RHEL 8.2 AUS | java-1.8.0-openjdk +7 | 1:1.8.0.492.b09-1.el8 | RHSA-2026:9683 |
| RHEL 7 ELS | firefox | 140.9.1-2.el7_9 | RHSA-2026:13977 |
| RHEL 7 ELS | libpng +2 | 2:1.5.13-8.el7_9.3 | RHSA-2026:50808 |
| RHEL 7 ELS | libpng12 +1 | 1.2.50-10.el7_9.2 | RHSA-2026:43702 |
| Red Hat Openjdk Els 11 | java-11-openjdk +17 | 1:11.0.31.0.11-1.el7_9 | RHSA-2026:9254 |
| Red Hat Openjdk Els 11 | java-11-openjdk-fastdebug +13 | 1:11.0.31.0.11-1.el8 | RHSA-2026:9254 |
| Red Hat Hardened Images 1 | libpng +3 | 1.6.56-1.hum1 | RHSA-2026:80330, RHSA-2026:6732 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | firefox | 140.9.1-1.el10_1 | ALSA-2026:7672 |
| AlmaLinux 10 | java-21-openjdk +22 | 1:21.0.11.0.10-2.el10_2.alma.1 | ALSA-2026:9689 |
| AlmaLinux 10 | java-25-openjdk +25 | 1:25.0.3.0.9-1.el10_2 | ALSA-2026:9693 |
| AlmaLinux 10 | libpng +1 | 2:1.6.40-8.el10_1.4 | ALSA-2026:28233, ALSA-2026:18064 |
| AlmaLinux 10 | thunderbird | 140.9.1-1.el10_1.alma.1 | ALSA-2026:9638 |
| AlmaLinux 9 | firefox +2 | 140.9.1-1.el9_7.alma.1 | ALSA-2026:8459, ALSA-2026:7671 |
| AlmaLinux 9 | java-1.8.0-openjdk +16 | 1:1.8.0.492.b09-2.el9.alma.1 | ALSA-2026:9683 |
| AlmaLinux 9 | java-17-openjdk +22 | 1:17.0.19.0.10-2.el9.alma.1 | ALSA-2026:9686 |
| AlmaLinux 9 | java-21-openjdk +22 | 1:21.0.11.0.10-2.el9.alma.1 | ALSA-2026:9689 |
| AlmaLinux 9 | java-25-openjdk +25 | 1:25.0.3.0.9-1.el9.alma.1 | ALSA-2026:9693 |
| AlmaLinux 9 | libpng +1 | 2:1.6.37-12.el9_7.4 | ALSA-2026:28255, ALSA-2026:18028 |
| AlmaLinux 9 | libpng15 | 1.5.30-15.el9_8.1 | ALSA-2026:28244 |
| AlmaLinux 8 | firefox +1 | 140.9.1-1.el8_10.alma.1 | ALSA-2026:9345, ALSA-2026:8052 |
| AlmaLinux 8 | java-1.8.0-openjdk +19 | 1:1.8.0.492.b09-1.el8 | ALSA-2026:9683 |
| AlmaLinux 8 | java-17-openjdk +22 | 1:17.0.19.0.10-1.el8 | ALSA-2026:9686 |
| AlmaLinux 8 | java-21-openjdk +22 | 1:21.0.11.0.10-1.el8 | ALSA-2026:9689 |
| AlmaLinux 8 | libpng +1 | 2:1.6.34-11.el8_10 | ALSA-2026:29898 |
| AlmaLinux 8 | libpng12 | 1.2.57-7.el8_10 | ALSA-2026:26348 |
| AlmaLinux 8 | libpng15 | 1.5.30-9.el8_10 | ALSA-2026:26347 |
| AlmaLinux 8 | mingw32-libpng +3 | 1.6.34-3.el8_10 | ALSA-2026:99225 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | firefox +1 | 140.9.1-1.el10_1 | RLSA-2026:9638, RLSA-2026:7672 |
| Rocky Linux 10 | java-25-openjdk | 1:25.0.3.0.9-1.el10_1 | RLSA-2026:9693 |
| Rocky Linux 10 | libpng | 2:1.6.40-8.el10_1.4 | RLSA-2026:28233, RLSA-2026:18064 |
| Rocky Linux 9 | firefox +1 | 140.9.1-1.el9_7 | RLSA-2026:8459, RLSA-2026:7671 |
| Rocky Linux 9 | libpng | 2:1.6.37-12.el9_7.4 | RLSA-2026:28255, RLSA-2026:18028 |
| Rocky Linux 9 | libpng15 | 1.5.30-15.el9_8.1 | RLSA-2026:28244 |
| Rocky Linux 8 | firefox +1 | 140.9.1-1.el8_10 | RLSA-2026:9345, RLSA-2026:8052 |
| Rocky Linux 8 | libpng | 2:1.6.34-11.el8_10 | RLSA-2026:29898 |
| Rocky Linux 8 | libpng12 | 1.2.57-7.el8_10 | RLSA-2026:26348 |
| Rocky Linux 8 | libpng15 | 1.5.30-9.el8_10 | RLSA-2026:26347 |
| Rocky Linux 8 | mingw32-libpng +3 | 1.6.34-3.el8_10 | RLSA-2026:99225 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | libpng16 | 1.6.40-150600.3.17.1 | SUSE-SU-2026:1368-1 |
| SLES 15 SP6 | libpng16 | 1.6.40-150600.3.17.1 | SUSE-SU-2026:1368-1 |
| SLES 15 SP5 | libpng16 | 1.6.34-150000.3.22.1 | SUSE-SU-2026:1323-1 |
| SLES 15 SP4 | libpng16 | 1.6.34-150000.3.22.1 | SUSE-SU-2026:1323-1 |
| SLES 12 SP5 | libpng15 | 1.5.22-10.10.1 | SUSE-SU-2026:1500-1 |
| SLES 12 SP5 | libpng16 | 1.6.8-15.21.1 | SUSE-SU-2026:1311-1 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | libpng16 | 1.6.44-160000.6.1 | SUSE-SU-2026:21138-1 |
| SLES for SAP 15 SP6 | libpng16 | 1.6.40-150600.3.17.1 | SUSE-SU-2026:1368-1 |
| SLES for SAP 15 SP5 | libpng16 | 1.6.34-150000.3.22.1 | SUSE-SU-2026:1323-1 |
| SLES for SAP 15 SP4 | libpng16 | 1.6.34-150000.3.22.1 | SUSE-SU-2026:1323-1 |
| SLES 16.0 | libpng16 | 1.6.44-160000.6.1 | SUSE-SU-2026:21138-1 |
| SLE Micro 6.2 | libpng16 | 1.6.44-160000.6.1 | SUSE-SU-2026:21000-1 |
| SLE Micro 6.1 | libpng16 | 1.6.43-slfo.1.1_4.1 | SUSE-SU-2026:23514-1, SUSE-SU-2026:21038-1 |
| SLE Micro 6.0 | libpng16 | 1.6.43-4.1 | SUSE-SU-2026:23063-1, SUSE-SU-2026:21067-1 |
| SLE Micro 5.5 | libpng16 | 1.6.34-150000.3.22.1 | SUSE-SU-2026:1323-1 |
| SLE Micro 5.4 | libpng16 | 1.6.34-150000.3.22.1 | SUSE-SU-2026:1323-1 |
| SLE Micro 5.3 | libpng16 | 1.6.34-150000.3.22.1 | SUSE-SU-2026:1323-1 |
| SLE Micro 5.2 | libpng16 | 1.6.34-150000.3.22.1 | SUSE-SU-2026:1323-1 |
| SLE HPC 15 SP5 | libpng16 | 1.6.34-150000.3.22.1 | SUSE-SU-2026:1323-1 |
| SLE HPC 15 SP4 | libpng16 | 1.6.34-150000.3.22.1 | SUSE-SU-2026:1323-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libpng12 | 1.2.59-5.1 | openSUSE-SU-2026:10640-1 |
| openSUSE Tumbleweed | libpng16 | 1.6.56-1.1 | openSUSE-SU-2026:10451-1 |
| openSUSE Leap 16.0 | libpng16 | 1.6.44-160000.6.1 | openSUSE-SU-2026:20466-1 |
| openSUSE Leap 15.6 | libpng16 | 1.6.40-150600.3.17.1 | SUSE-SU-2026:1368-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libpng | 1.6.56-r0 | — |
| Alpine v3.23 | libpng | 1.6.56-r0 | — |
| Alpine v3.22 | libpng | 1.6.56-r0 | — |
| Alpine v3.21 | libpng | 1.6.56-r0 | — |
| Alpine v3.20 | libpng | 1.6.56-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | firefox | 140.9.0-1.amzn2023.0.2 | ALAS2023-2026-1554 |
| Amazon Linux 2023 | libpng +3 | 2:1.6.37-10.amzn2023.0.12 | ALAS2023-2026-1563 |
| Amazon Linux 2 | libpng +2 | 2:1.5.13-8.amzn2.0.8 | ALAS2-2026-3244 |
| Amazon Linux 2 | libpng12 +1 | 1.2.50-10.amzn2.0.4 | ALAS2-2026-3243 |
| Amazon Linux 2 | thunderbird | 140.9.0-1.amzn2.0.2 | ALAS2-2026-3241 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | fltk +5 | No fix yet | — |
| Azure Linux 3 | libpng | 1.6.56-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | firefox +1 | 140.9.1-1.0.1.el10_1 | ELSA-2026-9638, ELSA-2026-7672 |
| Oracle Linux 10 | libpng +1 | 2:1.6.40-8.el10_1.4 | ELSA-2026-28233, ELSA-2026-18064 |
| Oracle Linux 9 | firefox +2 | 140.9.1-1.0.1.el9_7 | ELSA-2026-8459, ELSA-2026-7671 |
| Oracle Linux 9 | java-25-openjdk +25 | 1:25.0.3.0.9-1.0.1.el10_2 | ELSA-2026-9693 |
| Oracle Linux 9 | libpng +1 | 2:1.6.37-12.el9_7.4 | ELSA-2026-28255, ELSA-2026-18028 |
| Oracle Linux 9 | libpng15 | 1.5.30-15.el9_8.1 | ELSA-2026-28244 |
| Oracle Linux 8 | firefox +1 | 140.9.1-1.0.1.el8_10 | ELSA-2026-9345, ELSA-2026-8052 |
| Oracle Linux 8 | libpng +1 | 2:1.6.34-11.el8_10 | ELSA-2026-29898 |
| Oracle Linux 8 | libpng12 | 1.2.57-7.el8_10 | ELSA-2026-26348 |
| Oracle Linux 8 | libpng15 | 1.5.30-9.el8_10 | ELSA-2026-26347 |
| Oracle Linux 8 | mingw32-libpng +3 | 1.6.34-3.el8_10 | ELSA-2026-99225 |
| Oracle Linux 7 | firefox | 140.9.1-1.0.1.el7_9 | ELSA-2026-13977 |
| Oracle Linux 7 | libpng +2 | 2:1.5.13-8.0.5.el7 | ELSA-2026-50808 |
| Oracle Linux 7 | libpng12 +1 | 1.2.50-10.0.3.el7 | ELSA-2026-43702 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | libpng | 1.6.56-r0 | — |
Advisories 50
- ALSA-2026:99225 Moderate: mingw-libpng security update AlmaLinux Security Advisories · Nov 13, 2026
- RLSA-2026:99225 Moderate: mingw-libpng security update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-0870 libpng: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- ELSA-2026-99225 Moderate: mingw-libpng security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 12, 2026
- ALSA-2026:7672 Important: firefox security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:18064 Moderate: libpng security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:9638 Important: thunderbird security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:8459 Important: thunderbird security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7671 Important: firefox security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:28255 Moderate: libpng security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:28244 Moderate: libpng15 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:18028 Moderate: libpng security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:9693 Important: java-25-openjdk security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:28233 Moderate: libpng security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:9686 Important: java-17-openjdk security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:9689 Important: java-21-openjdk security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:9683 Important: java-1.8.0-openjdk security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:9345 Important: thunderbird security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:29898 Moderate: libpng security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:26347 Moderate: libpng15 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:26348 Moderate: libpng12 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:8052 Important: firefox security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-2919 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 27, 2026
- RHSA-2026:9693 Red Hat Security Advisory: java-25-openjdk security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:9689 Red Hat Security Advisory: java-21-openjdk security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:9686 Red Hat Security Advisory: java-17-openjdk security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:9683 Red Hat Security Advisory: java-1.8.0-openjdk security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:9254 Red Hat Security Advisory: Java 11 OpenJDK ELS Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:9638 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:9345 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:8459 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:8052 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:80330 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:7672 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:7671 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:6732 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:50808 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:43702 Red Hat Security Advisory: libpng12 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:29902 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:29900 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:29901 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:29898 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:29022 Red Hat Security Advisory: libpng12 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:29021 Red Hat Security Advisory: libpng15 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:29020 Red Hat Security Advisory: libpng12 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:29018 Red Hat Security Advisory: libpng12 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:29019 Red Hat Security Advisory: libpng15 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:29016 Red Hat Security Advisory: libpng15 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:28458 Red Hat Security Advisory: libpng15 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:28456 Red Hat Security Advisory: libpng15 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
References
- https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j
- https://github.com/pnggroup/libpng/pull/824
- https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb
- https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667
- https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25
- https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1