Skip to content
OpenAdvisories
High · 7.6 CVE-2026-33636 EUVD-2026-16269

LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64

Published Mar 26, 2026 · Updated Mar 26, 2026 · Assigned by GitHub_M

Description

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without verifying that enough input pixels remain. Because the implementation works backward from the end of the row, the final iteration dereferences pointers before the start of the row buffer (OOB read) and writes expanded pixel data to the same underflowed positions (OOB write). This is reachable via normal decoding of attacker-controlled PNG input if Neon is enabled. Version 1.6.56 fixes the issue.

Affected products

VendorProductAffectedFixed
pnggroup libpng >= 1.6.36, < 1.6.56 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libpng1.6 1.6.56-1 —
Debian 13 libpng1.6 1.6.48-1+deb13u4 DSA-6189-1
Debian 12 libpng1.6 1.6.39-2+deb12u4 DSA-6189-1
ReleasePackageFixed inAdvisory
Ubuntu 25.10 libpng1.6 1.6.50-1ubuntu0.5 —
Ubuntu 24.04 LTS libpng1.6 1.6.43-5ubuntu0.6 —
Ubuntu 22.04 LTS libpng1.6 1.6.37-3ubuntu0.5 —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS libpng1.6 1.6.37-2ubuntu0.1~esm3 —
ReleasePackageFixed inAdvisory
RHEL 10 firefox +1 140.9.1-1.el10_1 RHSA-2026:9638, RHSA-2026:7672
RHEL 10 java-21-openjdk +22 1:21.0.11.0.10-2.el10_2 RHSA-2026:9689
RHEL 10 java-25-openjdk +25 1:25.0.3.0.9-1.el10_2 RHSA-2026:9693
RHEL 10 libpng +1 2:1.6.40-8.el10_1.3 RHSA-2026:28233, RHSA-2026:14790
RHEL 9 firefox +2 140.9.1-1.el9_7 RHSA-2026:8459, RHSA-2026:7671
RHEL 9 java-1.8.0-openjdk +16 1:1.8.0.492.b09-2.el9 RHSA-2026:9683
RHEL 9 java-17-openjdk +22 1:17.0.19.0.10-2.el9 RHSA-2026:9686
RHEL 9 java-21-openjdk +22 1:21.0.11.0.10-2.el9 RHSA-2026:9689
RHEL 9 java-25-openjdk +25 1:25.0.3.0.9-1.el9 RHSA-2026:9693
RHEL 9 libpng +1 2:1.6.37-12.el9_7.3 RHSA-2026:28255, RHSA-2026:14791
RHEL 8 firefox +1 140.9.1-1.el8_10 RHSA-2026:9345, RHSA-2026:8052
RHEL 8 java-1.8.0-openjdk +19 1:1.8.0.492.b09-1.el8 RHSA-2026:9683
RHEL 8 java-17-openjdk +22 1:17.0.19.0.10-1.el8 RHSA-2026:9686
RHEL 8 java-21-openjdk +22 1:21.0.11.0.10-1.el8 RHSA-2026:9689
Show 16 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS firefox +1 140.9.1-1.el10_0 RHSA-2026:13665, RHSA-2026:11813
RHEL 10.0 EUS java-21-openjdk +22 1:21.0.11.0.10-1.el10_2 RHSA-2026:9689
RHEL 10.0 EUS libpng +1 2:1.6.40-8.el10_0.3 RHSA-2026:17567
RHEL 9.6 EUS firefox +2 140.9.1-1.el9_6 RHSA-2026:13583, RHSA-2026:13342
RHEL 9.6 EUS java-1.8.0-openjdk +16 1:1.8.0.492.b09-1.el9 RHSA-2026:9683
RHEL 9.6 EUS java-17-openjdk +22 1:17.0.19.0.10-1.el9 RHSA-2026:9686
RHEL 9.6 EUS java-21-openjdk +22 1:21.0.11.0.10-1.el9 RHSA-2026:9689
RHEL 9.6 EUS libpng +1 2:1.6.37-12.el9_6.3 RHSA-2026:17524
RHEL 9.4 EUS firefox +2 140.9.1-1.el9_4 RHSA-2026:13582, RHSA-2026:13533
RHEL 9.4 EUS java-1.8.0-openjdk +16 1:1.8.0.492.b09-1.el9 RHSA-2026:9683
RHEL 9.4 EUS java-17-openjdk +22 1:17.0.19.0.10-1.el9 RHSA-2026:9686
RHEL 9.4 EUS java-21-openjdk +22 1:21.0.11.0.10-1.el9 RHSA-2026:9689
RHEL 9.4 EUS libpng +1 2:1.6.37-12.el9_4.3 RHSA-2026:17603
RHEL 9.2 E4S firefox +2 140.9.1-1.el9_2 RHSA-2026:13922, RHSA-2026:13412
RHEL 9.2 E4S java-1.8.0-openjdk +6 1:1.8.0.492.b09-1.el9 RHSA-2026:9683
RHEL 9.2 E4S java-17-openjdk +8 1:17.0.19.0.10-1.el9 RHSA-2026:9686
RHEL 9.2 E4S libpng +1 2:1.6.37-12.el9_2.3 RHSA-2026:17642
RHEL 9.0 E4S firefox +1 140.9.1-1.el9_0 RHSA-2026:13596, RHSA-2026:12264
RHEL 9.0 E4S java-1.8.0-openjdk +6 1:1.8.0.492.b09-1.el9 RHSA-2026:9683
RHEL 9.0 E4S java-17-openjdk +8 1:17.0.19.0.10-1.el9 RHSA-2026:9686
RHEL 9.0 E4S libpng +1 2:1.6.37-12.el9_0.3 RHSA-2026:17685
RHEL 8.8 TUS firefox +1 140.9.1-1.el8_8 RHSA-2026:14223, RHSA-2026:13682
RHEL 8.8 TUS java-1.8.0-openjdk +7 1:1.8.0.492.b09-1.el8 RHSA-2026:9683
RHEL 8.8 TUS java-17-openjdk +8 1:17.0.19.0.10-1.el8 RHSA-2026:9686
RHEL 8.8 E4S firefox +1 140.9.1-1.el8_8 RHSA-2026:14223, RHSA-2026:13682
RHEL 8.8 E4S java-1.8.0-openjdk +7 1:1.8.0.492.b09-1.el8 RHSA-2026:9683
RHEL 8.8 E4S java-17-openjdk +8 1:17.0.19.0.10-1.el8 RHSA-2026:9686
RHEL 8.6 TUS firefox +1 140.9.1-1.el8_6 RHSA-2026:15889, RHSA-2026:13683
RHEL 8.6 TUS java-1.8.0-openjdk +7 1:1.8.0.492.b09-1.el8 RHSA-2026:9683
RHEL 8.6 TUS java-17-openjdk +8 1:17.0.19.0.10-1.el8 RHSA-2026:9686
RHEL 8.6 E4S firefox +1 140.9.1-1.el8_6 RHSA-2026:15889, RHSA-2026:13683
RHEL 8.6 E4S java-1.8.0-openjdk +7 1:1.8.0.492.b09-1.el8 RHSA-2026:9683
RHEL 8.6 E4S java-17-openjdk +8 1:17.0.19.0.10-1.el8 RHSA-2026:9686
RHEL 8.6 AUS firefox +1 140.9.1-1.el8_6 RHSA-2026:15889, RHSA-2026:13683
RHEL 8.6 AUS java-1.8.0-openjdk +7 1:1.8.0.492.b09-1.el8 RHSA-2026:9683
RHEL 8.6 AUS java-17-openjdk +8 1:17.0.19.0.10-1.el8 RHSA-2026:9686
RHEL 8.4 EUS Long Life firefox +1 140.9.1-1.el8_4 RHSA-2026:14303, RHSA-2026:13600
RHEL 8.4 EUS Long Life java-1.8.0-openjdk +7 1:1.8.0.492.b09-1.el8 RHSA-2026:9683
RHEL 8.4 EUS Long Life java-17-openjdk +22 1:17.0.19.0.10-1.el8 RHSA-2026:9686
RHEL 8.4 AUS firefox +1 140.9.1-1.el8_4 RHSA-2026:14303, RHSA-2026:13600
RHEL 8.4 AUS java-1.8.0-openjdk +7 1:1.8.0.492.b09-1.el8 RHSA-2026:9683
RHEL 8.4 AUS java-17-openjdk +8 1:17.0.19.0.10-1.el8 RHSA-2026:9686
RHEL 8.2 AUS firefox 140.9.1-1.el8_2 RHSA-2026:11805
RHEL 8.2 AUS java-1.8.0-openjdk +7 1:1.8.0.492.b09-1.el8 RHSA-2026:9683
RHEL 7 ELS firefox 140.9.1-2.el7_9 RHSA-2026:13977
Red Hat Openjdk Els 11 java-11-openjdk +17 1:11.0.31.0.11-1.el7_9 RHSA-2026:9254
Red Hat Openjdk Els 11 java-11-openjdk-fastdebug +13 1:11.0.31.0.11-1.el8 RHSA-2026:9254
Red Hat Hardened Images 1 libpng +3 1.6.56-1.hum1 RHSA-2026:80330, RHSA-2026:6732

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 firefox 140.9.1-1.el10_1 ALSA-2026:7672
AlmaLinux 10 java-21-openjdk +22 1:21.0.11.0.10-2.el10_2.alma.1 ALSA-2026:9689
AlmaLinux 10 java-25-openjdk +25 1:25.0.3.0.9-1.el10_2 ALSA-2026:9693
AlmaLinux 10 libpng +1 2:1.6.40-8.el10_1.3 ALSA-2026:28233, ALSA-2026:14790
AlmaLinux 10 thunderbird 140.9.1-1.el10_1.alma.1 ALSA-2026:9638
AlmaLinux 9 firefox +2 140.9.1-1.el9_7.alma.1 ALSA-2026:8459, ALSA-2026:7671
AlmaLinux 9 java-1.8.0-openjdk +16 1:1.8.0.492.b09-2.el9.alma.1 ALSA-2026:9683
AlmaLinux 9 java-17-openjdk +22 1:17.0.19.0.10-2.el9.alma.1 ALSA-2026:9686
AlmaLinux 9 java-21-openjdk +22 1:21.0.11.0.10-2.el9.alma.1 ALSA-2026:9689
AlmaLinux 9 java-25-openjdk +25 1:25.0.3.0.9-1.el9.alma.1 ALSA-2026:9693
AlmaLinux 9 libpng +1 2:1.6.37-12.el9_7.3 ALSA-2026:28255, ALSA-2026:14791
AlmaLinux 8 firefox +1 140.9.1-1.el8_10.alma.1 ALSA-2026:9345, ALSA-2026:8052
AlmaLinux 8 java-1.8.0-openjdk +19 1:1.8.0.492.b09-1.el8 ALSA-2026:9683
AlmaLinux 8 java-17-openjdk +22 1:17.0.19.0.10-1.el8 ALSA-2026:9686
AlmaLinux 8 java-21-openjdk +22 1:21.0.11.0.10-1.el8 ALSA-2026:9689

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 firefox +1 140.9.1-1.el10_1 RLSA-2026:9638, RLSA-2026:7672
Rocky Linux 10 java-25-openjdk 1:25.0.3.0.9-1.el10_1 RLSA-2026:9693
Rocky Linux 10 libpng 2:1.6.40-8.el10_1.3 RLSA-2026:28233, RLSA-2026:14790
Rocky Linux 9 firefox +1 140.9.1-1.el9_7 RLSA-2026:8459, RLSA-2026:7671
Rocky Linux 9 libpng 2:1.6.37-12.el9_7.3 RLSA-2026:28255, RLSA-2026:14791
Rocky Linux 8 firefox +1 140.9.1-1.el8_10 RLSA-2026:9345, RLSA-2026:8052
ReleasePackageFixed inAdvisory
SLES 15 SP7 libpng16 1.6.40-150600.3.17.1 SUSE-SU-2026:1368-1
SLES 15 SP6 libpng16 1.6.40-150600.3.17.1 SUSE-SU-2026:1368-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 libpng16 1.6.44-160000.6.1 SUSE-SU-2026:21138-1
SLES for SAP 15 SP6 libpng16 1.6.40-150600.3.17.1 SUSE-SU-2026:1368-1
SLES 16.0 libpng16 1.6.44-160000.6.1 SUSE-SU-2026:21138-1
SLE Micro 6.2 libpng16 1.6.44-160000.6.1 SUSE-SU-2026:21000-1
SLE Micro 6.1 libpng16 1.6.43-slfo.1.1_4.1 SUSE-SU-2026:23514-1, SUSE-SU-2026:21038-1
SLE Micro 6.0 libpng16 1.6.43-4.1 SUSE-SU-2026:23063-1, SUSE-SU-2026:21067-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed libpng16 1.6.56-1.1 openSUSE-SU-2026:10451-1
openSUSE Leap 16.0 libpng16 1.6.44-160000.6.1 openSUSE-SU-2026:20466-1
openSUSE Leap 15.6 libpng16 1.6.40-150600.3.17.1 SUSE-SU-2026:1368-1
ReleasePackageFixed inAdvisory
Alpine v3.24 libpng 1.6.56-r0 —
Alpine v3.23 libpng 1.6.56-r0 —
Alpine v3.22 libpng 1.6.56-r0 —
Alpine v3.21 libpng 1.6.56-r0 —
Alpine v3.20 libpng 1.6.56-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 firefox 140.9.0-1.amzn2023.0.2 ALAS2023-2026-1554
Amazon Linux 2023 libpng +3 2:1.6.37-10.amzn2023.0.12 ALAS2023-2026-1563
Amazon Linux 2 thunderbird 140.9.0-1.amzn2.0.2 ALAS2-2026-3241

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 fltk +1 No fix yet —
Azure Linux 3 libpng 1.6.56-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 firefox +1 140.9.1-1.0.1.el10_1 ELSA-2026-9638, ELSA-2026-7672
Oracle Linux 10 libpng +1 2:1.6.40-8.el10_1.3 ELSA-2026-28233, ELSA-2026-14790
Oracle Linux 9 firefox +2 140.9.1-1.0.1.el9_7 ELSA-2026-8459, ELSA-2026-7671
Oracle Linux 9 java-25-openjdk +25 1:25.0.3.0.9-1.0.1.el10_2 ELSA-2026-9693
Oracle Linux 9 libpng +1 2:1.6.37-12.el9_7.3 ELSA-2026-28255, ELSA-2026-14791
Oracle Linux 8 firefox +1 140.9.1-1.0.1.el8_10 ELSA-2026-9345, ELSA-2026-8052
Oracle Linux 7 firefox 140.9.1-1.0.1.el7_9 ELSA-2026-13977

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling libpng 1.6.56-r0 —

Advisories 50

References