EUVD-2026-16269CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Lifecycle Timeline
4Description
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without verifying that enough input pixels remain. Because the implementation works backward from the end of the row, the final iteration dereferences pointers before the start of the row buffer (OOB read) and writes expanded pixel data to the same underflowed positions (OOB write). This is reachable via normal decoding of attacker-controlled PNG input if Neon is enabled. Version 1.6.56 fixes the issue.
Analysis
Out-of-bounds read and write in libpng's ARM/AArch64 Neon-optimized palette expansion allows remote attackers to trigger memory corruption, information disclosure, and denial of service when processing malicious PNG files. libpng versions 1.6.36 through 1.6.55 are affected on ARM platforms with Neon optimization enabled. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all systems running libpng 1.6.36-1.6.55 on ARM/AArch64 architectures (inspect container images, embedded devices, and ARM servers); document exposure scope and prioritize internet-facing or data-processing systems. Within 7 days: Upgrade libpng to version 1.6.56 or later on all affected ARM systems; test patched builds in non-production environments first. …
Sign in for detailed remediation steps.
Priority Score
Vendor Status
Debian
Bug #1132013| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 1.6.37-3 | - |
| bullseye (security) | vulnerable | 1.6.37-3+deb11u2 | - |
| bookworm | vulnerable | 1.6.39-2+deb12u1 | - |
| bookworm (security) | vulnerable | 1.6.39-2+deb12u3 | - |
| trixie (security), trixie | vulnerable | 1.6.48-1+deb13u3 | - |
| forky, sid | vulnerable | 1.6.55-1 | - |
| (unstable) | fixed | (unfixed) | - |
Share
External POC / Exploit Code
Leaving vuln.today