Skip to content
OpenAdvisories
Medium · 5.1 CVE-2026-34757 EUVD-2026-20897

LIBPNG has a yse-after-free in png_set_PLTE, png_set_tRNS and png_set_hIST leading to corrupted chunk data and potential heap information disclosure

Published Apr 9, 2026 · Updated May 9, 2026 · Assigned by GitHub_M

Vendor: pnggroup Product: libpng Package: fltk Package: gdal Package: libpng Package: libpng Package: libpng Package: libpng Package: libpng1.6 Package: libpng1.6 Package: libpng12 Package: libpng15 Package: openjpeg2 Package: optipng Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct). This vulnerability is fixed in 1.6.57.

Affected products

VendorProductAffectedFixed
pnggroup libpng >= 1.0.9, < 1.6.57 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libpng1.6 1.6.57-1 —
Debian 13 libpng1.6 1.6.48-1+deb13u5 —
Debian 12 libpng1.6 1.6.39-2+deb12u5 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 libpng1.6 1.6.50-1ubuntu0.5 —
Ubuntu 24.04 LTS libpng1.6 1.6.43-5ubuntu0.6 —
Ubuntu 22.04 LTS libpng1.6 1.6.37-3ubuntu0.5 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS libpng1.6 1.6.37-2ubuntu0.1~esm3 —
Ubuntu Pro 18.04 LTS libpng1.6 1.6.34-1ubuntu0.18.04.2+esm3 —
Ubuntu Pro 16.04 LTS libpng 1.2.54-1ubuntu1.1+esm3 —
Ubuntu Pro 16.04 LTS libpng1.6 1.6.20-2ubuntu0.1~esm4 —
Ubuntu Pro 14.04 LTS libpng 1.2.50-1ubuntu2.14.04.3+esm2 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 libpng +3 1.6.57-0.1.hum1 RHSA-2026:13719

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 libpng16 1.6.40-150600.3.20.1 SUSE-SU-2026:1602-1
SLES 12 SP5 libpng15 1.5.22-10.10.1 SUSE-SU-2026:1500-1
SLES 12 SP5 libpng16 1.6.8-15.24.1 SUSE-SU-2026:1601-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.2 libpng16 1.6.44-160000.7.1 SUSE-SU-2026:21239-1
SLE Micro 6.1 libpng16 1.6.43-slfo.1.1_5.1 SUSE-SU-2026:23514-1, SUSE-SU-2026:21262-1
SLE Micro 6.0 libpng16 1.6.43-5.1 SUSE-SU-2026:23063-1, SUSE-SU-2026:21251-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed libpng12 1.2.59-5.1 openSUSE-SU-2026:10640-1
openSUSE Tumbleweed libpng16 1.6.57-1.1 openSUSE-SU-2026:10564-1
openSUSE Leap 16.0 libpng16 1.6.44-160000.7.1 openSUSE-SU-2026:20593-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 libpng 1.6.57-r0 —
Alpine v3.23 libpng 1.6.57-r0 —
Alpine v3.22 libpng 1.6.57-r0 —
Alpine v3.21 libpng 1.6.57-r0 —
Alpine v3.20 libpng 1.6.57-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 libpng +3 2:1.6.37-10.amzn2023.0.13 ALAS2023-2026-1670
Amazon Linux 2 libpng +2 2:1.5.13-8.amzn2.0.9 ALAS2-2026-3266

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 fltk +5 No fix yet —
Azure Linux 3 libpng 1.6.57-1 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling libpng 1.6.57-r0 —

Advisories 15

References