Skip to main content

Red Hat EUVDEUVD-2026-16269

| CVE-2026-33636 HIGH
Out-of-bounds Read (CWE-125)
2026-03-26 GitHub_M
Buffer Overflow Information Disclosure Red Hat
7.6
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
7.6 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
SUSE
8.6 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Red Hat
7.6 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High

Lifecycle Timeline

4
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 26, 2026 - 17:15 euvd
EUVD-2026-16269
Analysis Generated
Mar 26, 2026 - 17:15 vuln.today
CVE Published
Mar 26, 2026 - 16:51 nvd
HIGH 7.6

DescriptionGitHub Advisory

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without verifying that enough input pixels remain. Because the implementation works backward from the end of the row, the final iteration dereferences pointers before the start of the row buffer (OOB read) and writes expanded pixel data to the same underflowed positions (OOB write). This is reachable via normal decoding of attacker-controlled PNG input if Neon is enabled. Version 1.6.56 fixes the issue.

Articles & Coverage 1

securityonline.info Critical RCE and UAF Flaws in libpng: CVE-2026-33416 and CVE-2026-33636

AnalysisAI

Out-of-bounds read and write in libpng's ARM/AArch64 Neon-optimized palette expansion allows remote attackers to trigger memory corruption, information disclosure, and denial of service when processing malicious PNG files. libpng versions 1.6.36 through 1.6.55 are affected on ARM platforms with Neon optimization enabled. Version 1.6.56 contains the fix. No public exploit identified at time of analysis, with SSVC framework indicating no active exploitation, non-automatable attack vector, and partial technical impact.

Technical ContextAI

LIBPNG (cpe:2.3:a:pnggroup:libpng) is the reference implementation for PNG image processing used across countless applications and operating systems. This vulnerability stems from CWE-125 (Out-of-bounds Read) in the ARM/AArch64 Neon SIMD-optimized code path that expands 8-bit indexed color (paletted) images to full RGB or RGBA format. The Neon implementation processes pixel data in vectorized chunks working backward from the end of the row buffer. When the final partial chunk is smaller than a full vector width, the code fails to validate remaining input pixel count before dereferencing pointers, causing both read and write operations to occur before the allocated buffer start address. This architectural optimization flaw is specific to ARM processors with Neon SIMD extensions and does not affect x86 or other architectures.

RemediationAI

Upgrade libpng to version 1.6.56 or later, which contains the complete fix per the upstream commits at https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869 and https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3. Organizations using Debian or SUSE Linux distributions should apply vendor-provided security updates through their normal package management channels as these distributions are actively tracking the issue. For systems where immediate patching is not feasible, consider disabling Neon optimizations at compile time (if rebuilding from source) or implementing strict input validation to reject PNG files from untrusted sources. ARM-based embedded systems and image processing servers should prioritize this update. Refer to the GitHub security advisory GHSA-wjr5-c57x-95m2 for additional details and the VulDB entry at https://vuldb.com/?id.353557 for tracking information.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

Debian

Bug #1132013
libpng1.6
Release Status Fixed Version Urgency
bullseye vulnerable 1.6.37-3 -
bullseye (security) vulnerable 1.6.37-3+deb11u2 -
bookworm vulnerable 1.6.39-2+deb12u1 -
bookworm (security) vulnerable 1.6.39-2+deb12u3 -
trixie (security), trixie vulnerable 1.6.48-1+deb13u3 -
forky, sid vulnerable 1.6.55-1 -
(unstable) fixed (unfixed) -

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.2 Fixed

Share

EUVD-2026-16269 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy