Executive brief
libpng is a widely used library for reading and writing PNG image files. A vulnerability exists where certain programming patterns can cause the library to read from memory that has already been cleared, potentially leading to the silent corruption of image data or the accidental exposure of sensitive information from the computer's memory. This issue affects applications that process PNG images using specific library functions.
Technical details
A use-after-free vulnerability exists in libpng versions 1.0.9 through 1.6.56. The issue occurs when a pointer obtained from a getter function (such as png_get_PLTE, png_get_tRNS, or png_get_hIST) is passed directly back into the corresponding setter function (e.g., png_set_PLTE) for the same png_struct/png_info pair. The setter functions incorrectly free the internal buffer before copying data from the caller-supplied pointer, which then becomes a dangling pointer. This results in the library reading from freed memory, which may contain stale data or contents from subsequent heap allocations, leading to heap information leakage or corrupted chunk metadata. The vulnerability is fixed in version 1.6.57 by snapshotting data before freeing internal storage.
Affected products
- libpng project libpng 1.0.9 to before 1.6.57
Timeline
- 2026-03-30: patched: Fixes committed to libpng repository
- 2026-04-09: disclosed: Initial advisory published
- 2026-04-09: advisory: NVD published date
References
- https://github.com/pnggroup/libpng/commit/398cbe3df03f4e11bb031e07f416dfdde3684e8a
- https://github.com/pnggroup/libpng/commit/55d20aaa322c9274491cda82c5cd4f99b48c6bcc
- https://github.com/pnggroup/libpng/issues/836
- https://github.com/pnggroup/libpng/issues/837
- https://github.com/pnggroup/libpng/security/advisories/GHSA-6fr7-g8h7-v645
- https://lists.debian.org/debian-lts-announce/2026/05/msg00017.html