Skip to content
OpenAdvisories
Critical · 9.8 CVE-2026-58936 EUVD-2026-115383GHSA-4vmq-xgp9-j3px

In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote code execution with n…

Published Nov 2, 2026 · Updated Nov 4, 2026 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

VendorProductAffectedFixed
Google Android 17, 16-qpr2, 16, 15, 14 —

Advisories 2

References