PT-2026-31620 · Libpng+2 · Libpng+2

Tobias Frost · Published 2026-04-09 · Updated 2026-05-18 · CVE-2026-34757

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LIBPNG versions 1.0.9 through 1.6.56

Description LIBPNG is a library used by applications to read, create, and manipulate PNG image files. A flaw exists where passing a pointer obtained from png get PLTE, png get tRNS, or png get hIST back into the corresponding setter function on the same png struct/png info pair can lead to reading from freed memory. This occurs because the setter frees the internal buffer before copying data from the provided pointer, which is now invalid. This can result in silently corrupted chunk metadata or leakage of unrelated heap contents into the chunk structure.

Recommendations Update to version 1.6.57 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2026-06672

CLEANSTART-2026-CF62516

CLEANSTART-2026-EP51501

CVE-2026-34757

ECHO-7EDB-B098-20D5

OESA-2026-2149

OPENSUSE-SU-2026:10564-1

OPENSUSE-SU-2026:10640-1

OPENSUSE-SU-2026:20593-1

RHSA-2026:13719

SUSE-SU-2026:1500-1

SUSE-SU-2026:1601-1

SUSE-SU-2026:1602-1

SUSE-SU-2026:21239-1

SUSE-SU-2026:21251-1

SUSE-SU-2026:21262-1

USN-8251-1

Affected Products

Libpng

Linuxmint

Ubuntu

References · 103

• 🔥 https://github.com/pnggroup/libpng/issues/837 · Exploit
• 🔥 https://github.com/pnggroup/libpng/issues/836 · Exploit
• https://github.com/pnggroup/libpng/commit/398cbe3df03f4e11bb031e07f416dfdde3684e8a · Patch
• https://github.com/pnggroup/libpng/commit/55d20aaa322c9274491cda82c5cd4f99b48c6bcc · Patch
• https://github.com/pnggroup/libpng/security/advisories/GHSA-6fr7-g8h7-v645 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34757 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06672 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22184 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10640-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33870 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33871 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10564-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1225 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34757 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34757 · Vendor Advisory