Every CVE Search/ Get API key

CVE-2026-46675

Fix CVE(s): CVE-2026-46675

5.9 MediumFix available
  • SECURITY UPDATE: use-after-free through stale zstream pointers
    • debian/patches/CVE-2026-46675.patch: add png_inflate_detach_buffers to clear the zstream input and output pointers and counters, and call it on claim in png_inflate_claim and on release in png_decompress_chunk, png_handle_iCCP and png_read_finish_IDAT (pngrutil.c), so that png_read_end called before row reading no longer inflates through a stale next_in into a freed buffer
    • CVE-2026-46675

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

What each source reports

OSV Score usedOESA-2026-4396 5.9

libpng security update

The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems.

Security Fix(es):

Use-after-free of zlib input in png_read_end after incomplete zTXt, iTXt or iCCP decompression

Record
OESA-2026-4396
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV Score usedOESA-2026-4397 5.9

libpng security update

The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems.

Security Fix(es):

Use-after-free of zlib input in png_read_end after incomplete zTXt, iTXt or iCCP decompression

Record
OESA-2026-4397
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV Score usedOESA-2026-4398 5.9

libpng security update

The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems.

Security Fix(es):

Use-after-free of zlib input in png_read_end after incomplete zTXt, iTXt or iCCP decompression

Record
OESA-2026-4398
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV Score usedOESA-2026-4399 5.9

libpng security update

The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems.

Security Fix(es):

Use-after-free of zlib input in png_read_end after incomplete zTXt, iTXt or iCCP decompression

Record
OESA-2026-4399
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV Score usedRHSA-2026:84420 5.9

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:84420
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1791824192 No score

Fix CVE(s): CVE-2026-46675

  • SECURITY UPDATE: use-after-free through stale zstream pointers
    • debian/patches/CVE-2026-46675.patch: add png_inflate_detach_buffers to clear the zstream input and output pointers and counters, and call it on claim in png_inflate_claim and on release in png_decompress_chunk, png_handle_iCCP and png_read_finish_IDAT (pngrutil.c), so that png_read_end called before row reading no longer inflates through a stale next_in into a freed buffer
    • CVE-2026-46675
Record
CLSA-2026-1791824192
Updated
2026-11-02
Show 10 moreShow less
OSVMGASA-2026-0520 No score

Updated libpng package fixes a security vulnerability

Use-after-free of zlib input in png_read_end after incomplete zTXt, iTXt or iCCP decompression. (CVE-2026-46675)

Record
MGASA-2026-0520
Updated
2026-11-02
OSVopenSUSE-SU-2026:11984-1 No score

libpng16-16-1.6.59-1.1 on GA media

These are all security issues fixed in the libpng16-16-1.6.59-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11984-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22084-1 No score

Security update for libpng16

This update for libpng16 fixes the following issue:

  • CVE-2026-46675: Use-after-free of zlib input in png_read_end after incomplete zTXt, iTXt or iCCP decompression (bsc#1283183).

Changes for libpng16:

  • version update to 1.6.59:
  • Fixed CVE-2026-46675 (medium severity): Use-after-free of zlib input in png_read_end after incomplete zTXt, iTXt or iCCP decompression. (Reported independently by Ze Sheng and [email protected].)
  • Fixed a regression introduced in version 1.6.47 that caused libpng to reject hIST chunks in their correct position, after PLTE. (Contributed by Yuki Sekiguchi.)
  • Prevented a double free of png_struct members after an allocation failure. (Contributed by Anthony Hurtado.)
  • Applied fixes and updates to the CMake build.
  • Adopted the REUSE Specification for licensing the CI files.
Record
openSUSE-SU-2026:22084-1
Updated
2026-11-02
OSVSUSE-SU-2026:24130-1 No score

Security update for libpng16

This update for libpng16 fixes the following issue:

  • CVE-2026-46675: Use-after-free of zlib input in png_read_end after incomplete zTXt, iTXt or iCCP decompression (bsc#1283183).

Changes for libpng16:

  • version update to 1.6.59:
  • Fixed CVE-2026-46675 (medium severity): Use-after-free of zlib input in png_read_end after incomplete zTXt, iTXt or iCCP decompression. (Reported independently by Ze Sheng and [email protected].)
  • Fixed a regression introduced in version 1.6.47 that caused libpng to reject hIST chunks in their correct position, after PLTE. (Contributed by Yuki Sekiguchi.)
  • Prevented a double free of png_struct members after an allocation failure. (Contributed by Anthony Hurtado.)
  • Applied fixes and updates to the CMake build.
  • Adopted the REUSE Specification for licensing the CI files.
Record
SUSE-SU-2026:24130-1
Updated
2026-11-02
OSVSUSE-SU-2026:24228-1 No score

Security update for libpng16

This update for libpng16 fixes the following issue:

  • CVE-2026-46675: Use-after-free of zlib input in png_read_end after incomplete zTXt, iTXt or iCCP decompression (bsc#1283183).

Changes for libpng16:

  • version update to 1.6.59:
  • Fixed CVE-2026-46675 (medium severity): Use-after-free of zlib input in png_read_end after incomplete zTXt, iTXt or iCCP decompression. (Reported independently by Ze Sheng and [email protected].)
  • Fixed a regression introduced in version 1.6.47 that caused libpng to reject hIST chunks in their correct position, after PLTE. (Contributed by Yuki Sekiguchi.)
  • Prevented a double free of png_struct members after an allocation failure. (Contributed by Anthony Hurtado.)
  • Applied fixes and updates to the CMake build.
  • Adopted the REUSE Specification for licensing the CI files.
Record
SUSE-SU-2026:24228-1
Updated
2026-11-02
OSVSUSE-SU-2026:4796-1 No score

Security update for libpng16

This update for libpng16 fixes the following issue:

  • CVE-2026-46675: Use-after-free of zlib input in png_read_end after incomplete zTXt, iTXt or iCCP decompression (bsc#1283183).

Changes for libpng16:

  • version update to 1.6.59:
  • Fixed a regression introduced in version 1.6.47 that caused libpng to reject hIST chunks in their correct position, after PLTE.
  • Prevented a double free of png_struct members after an allocation failure.
  • Applied fixes and updates to the CMake build.
  • Adopted the REUSE Specification for licensing the CI files.
Record
SUSE-SU-2026:4796-1
Updated
2026-11-02
OSVSUSE-SU-2026:4801-1 No score

Security update for libpng16

This update for libpng16 fixes the following issues:

  • CVE-2026-46675: Use-after-free of zlib input in png_read_end after incomplete zTXt, iTXt or iCCP decompression (bsc#1283183).

Changes for libpng16:

  • version update to 1.6.59 (jsc#PED-16190):
  • Fixed a regression introduced in version 1.6.47 that caused libpng to reject hIST chunks in their correct position, after PLTE.
  • Prevented a double free of png_struct members after an allocation failure.
  • Applied fixes and updates to the CMake build.
  • Adopted the REUSE Specification for licensing the CI files.
Record
SUSE-SU-2026:4801-1
Updated
2026-11-02
OSVSUSE-SU-2026:4814-1 No score

Security update for libpng16

This update for libpng16 fixes the following issues:

  • CVE-2026-46675: Use-after-free of zlib input in png_read_end after incomplete zTXt, iTXt or iCCP decompression (bsc#1283183).

Changes for libpng16:

  • version update to 1.6.59 (jsc#PED-16190):
  • Fixed a regression introduced in version 1.6.47 that caused libpng to reject hIST chunks in their correct position, after PLTE.
  • Prevented a double free of png_struct members after an allocation failure.
  • Applied fixes and updates to the CMake build.
  • Adopted the REUSE Specification for licensing the CI files.
Record
SUSE-SU-2026:4814-1
Updated
2026-11-02
OSVUBUNTU-CVE-2026-46675 No score

[Use-after-free of zlib input in png_read_end after incomplete zTXt, iTXt or iCCP decompression]

Record
UBUNTU-CVE-2026-46675
Updated
2026-11-02
OSVUSN-8899-1 No score

libpng1.6 vulnerability

Ze Sheng discovered that libpng incorrectly handled certain compressed data chunks in PNG files. An attacker could possibly use this issue to cause a denial of service.

Record
USN-8899-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
libpng
Alpaquita:23
 1.6.38-r0 up to 1.6.59-r0
1.6.59-r0
libpng
Alpaquita:25
 1.6.47-r0 up to 1.6.59-r0
1.6.59-r0
libpng
Alpaquita:stream
 1.6.38-r0 up to 1.6.59-r0
1.6.59-r0
libpng
BellSoft Hardened Containers:23
 1.6.38-r0 up to 1.6.59-r0
1.6.59-r0
libpng
BellSoft Hardened Containers:25
 1.6.47-r0 up to 1.6.59-r0
1.6.59-r0
libpng
BellSoft Hardened Containers:stream
 1.6.38-r0 up to 1.6.59-r0
1.6.59-r0
libpng-dev
TuxCare:Ubuntu:20.04
 before 1.6.37-2+tuxcare.els6
1.6.37-2+tuxcare.els6
libpng-tools
TuxCare:Ubuntu:20.04
 before 1.6.37-2+tuxcare.els6
1.6.37-2+tuxcare.els6
libpng16-16
TuxCare:Ubuntu:20.04
 before 1.6.37-2+tuxcare.els6
1.6.37-2+tuxcare.els6
libpng1.6
Debian:12
 before 1.6.39-2+deb12u6, plus listed versions
1.6.39-21.6.39-2+deb12u11.6.39-2+deb12u21.6.39-2+deb12u31.6.39-2+deb12u41.6.39-2+deb12u5
1.6.39-2+deb12u6
Show 27 moreShow less
Affected packages
PackageAffectedFixed
libpng1.6
Debian:13
 before 1.6.48-1+deb13u6, plus listed versions
1.6.48-11.6.48-1+deb13u11.6.48-1+deb13u21.6.48-1+deb13u31.6.48-1+deb13u41.6.48-1+deb13u5
1.6.48-1+deb13u6
libpng1.6
Debian:14
 before 1.6.59-1, plus listed versions
1.6.48-11.6.49-1~exp11.6.50-11.6.50-1~exp11.6.51-1
Show 7 moreShow less
1.6.52-11.6.53-11.6.54-11.6.55-11.6.56-11.6.57-11.6.58-1
1.6.59-1
libpng
Mageia:10
 before 1.6.53-6.1.mga10
1.6.53-6.1.mga10
libpng
openEuler:24.03-LTS-SP1
 before 1.6.40-13.oe2403sp1
1.6.40-13.oe2403sp1
libpng
openEuler:24.03-LTS-SP3
 before 1.6.40-13.oe2403sp3
1.6.40-13.oe2403sp3
libpng
openEuler:24.03-LTS-SP4
 before 1.6.40-12.oe2403sp4
1.6.40-12.oe2403sp4
libpng
openEuler:22.03-LTS-SP4
 before 1.6.38-11.oe2203sp4
1.6.38-11.oe2203sp4
libpng
Red Hat:hummingbird:1
 before 0:1.6.59-0.1.hum1
0:1.6.59-0.1.hum1
libpng-devel
Red Hat:hummingbird:1
 before 0:1.6.59-0.1.hum1
0:1.6.59-0.1.hum1
libpng-static
Red Hat:hummingbird:1
 before 0:1.6.59-0.1.hum1
0:1.6.59-0.1.hum1
libpng-tools
Red Hat:hummingbird:1
 before 0:1.6.59-0.1.hum1
0:1.6.59-0.1.hum1
libpng16
SUSE:Linux Micro 6.2
 before 1.6.59-160000.1.1
1.6.59-160000.1.1
libpng16
SUSE:Linux Enterprise Server 16.0
 before 1.6.59-160000.1.1
1.6.59-160000.1.1
libpng16
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.6.59-160000.1.1
1.6.59-160000.1.1
libpng16
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.6.59-150600.3.26.1
1.6.59-150600.3.26.1
libpng16
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 1.6.59-15.27.1
1.6.59-15.27.1
libpng16
SUSE:Linux Enterprise Micro 5.3
 before 1.6.59-150000.3.28.1
1.6.59-150000.3.28.1
libpng16
SUSE:Linux Enterprise Micro 5.4
 before 1.6.59-150000.3.28.1
1.6.59-150000.3.28.1
libpng16
SUSE:Linux Enterprise Micro 5.5
 before 1.6.59-150000.3.28.1
1.6.59-150000.3.28.1
libpng1.6
Ubuntu:Pro:16.04:LTS
 before 1.6.20-2ubuntu0.1~esm5, plus listed versions
1.6.20-21.6.20-2ubuntu0.1~esm11.6.20-2ubuntu0.1~esm21.6.20-2ubuntu0.1~esm31.6.20-2ubuntu0.1~esm4
1.6.20-2ubuntu0.1~esm5
libpng1.6
Ubuntu:Pro:18.04:LTS
 before 1.6.34-1ubuntu0.18.04.2+esm4, plus listed versions
1.6.34-11.6.34-1ubuntu0.18.04.11.6.34-1ubuntu0.18.04.21.6.34-1ubuntu0.18.04.2+esm11.6.34-1ubuntu0.18.04.2+esm21.6.34-1ubuntu0.18.04.2+esm3
1.6.34-1ubuntu0.18.04.2+esm4
libpng1.6
Ubuntu:Pro:20.04:LTS
 before 1.6.37-2ubuntu0.1~esm4, plus listed versions
1.6.37-11.6.37-21.6.37-2ubuntu0.1~esm11.6.37-2ubuntu0.1~esm21.6.37-2ubuntu0.1~esm3
1.6.37-2ubuntu0.1~esm4
libpng1.6
Ubuntu:22.04:LTS
 before 1.6.37-3ubuntu0.7, plus listed versions
1.6.37-3build41.6.37-3build51.6.37-3ubuntu0.11.6.37-3ubuntu0.31.6.37-3ubuntu0.41.6.37-3ubuntu0.51.6.37-3ubuntu0.6
1.6.37-3ubuntu0.7
libpng1.6
Ubuntu:24.04:LTS
 before 1.6.43-5ubuntu0.7, plus listed versions
1.6.40-11.6.40-21.6.40-31.6.42-11.6.43-1
Show 7 moreShow less
1.6.43-31.6.43-5build11.6.43-5ubuntu0.11.6.43-5ubuntu0.31.6.43-5ubuntu0.41.6.43-5ubuntu0.51.6.43-5ubuntu0.6
1.6.43-5ubuntu0.7
libpng1.6
Ubuntu:26.04:LTS
 before 1.6.57-1ubuntu0.1, plus listed versions
1.6.50-11.6.51-11.6.53-11.6.54-11.6.55-11.6.56-11.6.57-1
1.6.57-1ubuntu0.1
libpng16
openSUSE:Tumbleweed
 before 1.6.59-1.1
1.6.59-1.1
libpng16
openSUSE:Leap 16.0
 before 1.6.59-160000.1.1
1.6.59-160000.1.1

History

History
RecordedChangedSources
first indexedOSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-46675 is a medium vulnerability (CVSS 5.9) in libpng, published September 29, 2026. No source lists public exploit code. Fixed in libpng 1.6.59-r0.

References

Show 25 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open