{"id":"CVE-2026-46675","aliases":["BELL-CVE-2026-46675","CLSA-2026-1791824192","DEBIAN-CVE-2026-46675","MGASA-2026-0520","OESA-2026-4396","OESA-2026-4397","OESA-2026-4398","OESA-2026-4399","RHSA-2026:84420","SUSE-SU-2026:24130-1","SUSE-SU-2026:24228-1","SUSE-SU-2026:4796-1","SUSE-SU-2026:4801-1","SUSE-SU-2026:4814-1","UBUNTU-CVE-2026-46675","USN-8899-1","openSUSE-SU-2026:11984-1","openSUSE-SU-2026:22084-1"],"status":"published","title":"Fix CVE(s): CVE-2026-46675","description":"* SECURITY UPDATE: use-after-free through stale zstream pointers\n     - debian/patches/CVE-2026-46675.patch: add png_inflate_detach_buffers\n       to clear the zstream input and output pointers and counters, and\n       call it on claim in png_inflate_claim and on release in\n       png_decompress_chunk, png_handle_iCCP and png_read_finish_IDAT\n       (pngrutil.c), so that png_read_end called before row reading no\n       longer inflates through a stale next_in into a freed buffer\n     - CVE-2026-46675","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-09-29T00:00:00Z","modified":"2026-10-26T09:32:06Z","fixes":[{"ecosystem":"Alpaquita:23","package":"libpng","fixed_in":["1.6.59-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libpng","fixed_in":["1.6.59-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libpng","fixed_in":["1.6.59-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"libpng","fixed_in":["1.6.59-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"libpng","fixed_in":["1.6.59-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"libpng","fixed_in":["1.6.59-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libpng-dev","fixed_in":["1.6.37-2+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libpng-tools","fixed_in":["1.6.37-2+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libpng16-16","fixed_in":["1.6.37-2+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libpng1.6","fixed_in":["1.6.39-2+deb12u6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libpng1.6","fixed_in":["1.6.48-1+deb13u6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libpng1.6","fixed_in":["1.6.59-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"libpng","fixed_in":["1.6.53-6.1.mga10"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libpng","fixed_in":["1.6.40-13.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libpng","fixed_in":["1.6.40-13.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"libpng","fixed_in":["1.6.40-12.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libpng","fixed_in":["1.6.38-11.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"libpng","fixed_in":["0:1.6.59-0.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"libpng-devel","fixed_in":["0:1.6.59-0.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"libpng-static","fixed_in":["0:1.6.59-0.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"libpng-tools","fixed_in":["0:1.6.59-0.1.hum1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"libpng16","fixed_in":["1.6.59-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libpng16","fixed_in":["1.6.59-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libpng16","fixed_in":["1.6.59-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libpng16","fixed_in":["1.6.59-150600.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libpng16","fixed_in":["1.6.59-15.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libpng16","fixed_in":["1.6.59-150000.3.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libpng16","fixed_in":["1.6.59-150000.3.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libpng16","fixed_in":["1.6.59-150000.3.28.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libpng1.6","fixed_in":["1.6.20-2ubuntu0.1~esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libpng1.6","fixed_in":["1.6.34-1ubuntu0.18.04.2+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libpng1.6","fixed_in":["1.6.37-2ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libpng1.6","fixed_in":["1.6.37-3ubuntu0.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libpng1.6","fixed_in":["1.6.43-5ubuntu0.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libpng1.6","fixed_in":["1.6.57-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libpng16","fixed_in":["1.6.59-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"libpng16","fixed_in":["1.6.59-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"libpng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.38-r0"},{"fixed":"1.6.59-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libpng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.47-r0"},{"fixed":"1.6.59-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libpng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.38-r0"},{"fixed":"1.6.59-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"libpng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.38-r0"},{"fixed":"1.6.59-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"libpng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.47-r0"},{"fixed":"1.6.59-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"libpng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.38-r0"},{"fixed":"1.6.59-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libpng-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.37-2+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libpng-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.37-2+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libpng16-16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.37-2+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libpng1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.39-2+deb12u6"}]}],"versions":["1.6.39-2","1.6.39-2+deb12u1","1.6.39-2+deb12u2","1.6.39-2+deb12u3","1.6.39-2+deb12u4","1.6.39-2+deb12u5"]},{"source":"osv","ecosystem":"Debian:13","package":"libpng1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.48-1+deb13u6"}]}],"versions":["1.6.48-1","1.6.48-1+deb13u1","1.6.48-1+deb13u2","1.6.48-1+deb13u3","1.6.48-1+deb13u4","1.6.48-1+deb13u5"]},{"source":"osv","ecosystem":"Debian:14","package":"libpng1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.59-1"}]}],"versions":["1.6.48-1","1.6.49-1~exp1","1.6.50-1","1.6.50-1~exp1","1.6.51-1","1.6.52-1","1.6.53-1","1.6.54-1","1.6.55-1","1.6.56-1","1.6.57-1","1.6.58-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"libpng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.53-6.1.mga10"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libpng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.40-13.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libpng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.40-13.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libpng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.40-12.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libpng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.38-11.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libpng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.59-0.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libpng-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.59-0.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libpng-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.59-0.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libpng-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.59-0.1.hum1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libpng16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.59-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libpng16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.59-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libpng16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.59-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libpng16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.59-150600.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libpng16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.59-15.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libpng16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.59-150000.3.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libpng16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.59-150000.3.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libpng16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.59-150000.3.28.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libpng1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-2ubuntu0.1~esm5"}]}],"versions":["1.6.20-2","1.6.20-2ubuntu0.1~esm1","1.6.20-2ubuntu0.1~esm2","1.6.20-2ubuntu0.1~esm3","1.6.20-2ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libpng1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.34-1ubuntu0.18.04.2+esm4"}]}],"versions":["1.6.34-1","1.6.34-1ubuntu0.18.04.1","1.6.34-1ubuntu0.18.04.2","1.6.34-1ubuntu0.18.04.2+esm1","1.6.34-1ubuntu0.18.04.2+esm2","1.6.34-1ubuntu0.18.04.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libpng1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.37-2ubuntu0.1~esm4"}]}],"versions":["1.6.37-1","1.6.37-2","1.6.37-2ubuntu0.1~esm1","1.6.37-2ubuntu0.1~esm2","1.6.37-2ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libpng1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.37-3ubuntu0.7"}]}],"versions":["1.6.37-3build4","1.6.37-3build5","1.6.37-3ubuntu0.1","1.6.37-3ubuntu0.3","1.6.37-3ubuntu0.4","1.6.37-3ubuntu0.5","1.6.37-3ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libpng1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.43-5ubuntu0.7"}]}],"versions":["1.6.40-1","1.6.40-2","1.6.40-3","1.6.42-1","1.6.43-1","1.6.43-3","1.6.43-5build1","1.6.43-5ubuntu0.1","1.6.43-5ubuntu0.3","1.6.43-5ubuntu0.4","1.6.43-5ubuntu0.5","1.6.43-5ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libpng1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.57-1ubuntu0.1"}]}],"versions":["1.6.50-1","1.6.51-1","1.6.53-1","1.6.54-1","1.6.55-1","1.6.56-1","1.6.57-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libpng1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-2ubuntu0.1~esm5"}]}],"versions":["1.6.20-2","1.6.20-2ubuntu0.1~esm1","1.6.20-2ubuntu0.1~esm2","1.6.20-2ubuntu0.1~esm3","1.6.20-2ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libpng1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.34-1ubuntu0.18.04.2+esm4"}]}],"versions":["1.6.34-1","1.6.34-1ubuntu0.18.04.1","1.6.34-1ubuntu0.18.04.2","1.6.34-1ubuntu0.18.04.2+esm1","1.6.34-1ubuntu0.18.04.2+esm2","1.6.34-1ubuntu0.18.04.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libpng1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.37-2ubuntu0.1~esm4"}]}],"versions":["1.6.37-1","1.6.37-2","1.6.37-2ubuntu0.1~esm1","1.6.37-2ubuntu0.1~esm2","1.6.37-2ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libpng1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.37-3ubuntu0.7"}]}],"versions":["1.6.37-3build4","1.6.37-3build5","1.6.37-3ubuntu0.1","1.6.37-3ubuntu0.3","1.6.37-3ubuntu0.4","1.6.37-3ubuntu0.5","1.6.37-3ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libpng1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.43-5ubuntu0.7"}]}],"versions":["1.6.40-1","1.6.40-2","1.6.40-3","1.6.42-1","1.6.43-1","1.6.43-3","1.6.43-5build1","1.6.43-5ubuntu0.1","1.6.43-5ubuntu0.3","1.6.43-5ubuntu0.4","1.6.43-5ubuntu0.5","1.6.43-5ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libpng1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.57-1ubuntu0.1"}]}],"versions":["1.6.50-1","1.6.51-1","1.6.53-1","1.6.54-1","1.6.55-1","1.6.56-1","1.6.57-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libpng16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.59-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libpng16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.59-160000.1.1"}]}]}],"references":[{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-46675","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1791824192.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46675","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-46675","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0520.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36403","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/29/4","tags":["web"]},{"url":"https://github.com/pnggroup/libpng/security/advisories/GHSA-qvg3-h654-xq3j","tags":["advisory","article","report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00450.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4396","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4397","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4398","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4399","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84420","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-46675","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84420.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553266","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46675","tags":["advisory","report"]},{"url":"https://github.com/pnggroup/libpng/commit/aa77ef38c17ab2fc1b41bec09fb973c6a386641d","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624130-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283183","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46675","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624228-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264796-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264801-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264814-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-46675","tags":["report"]},{"url":"https://github.com/pnggroup/libpng/issues/855","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8899-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"osv":[{"id":"OESA-2026-4396","title":"libpng security update","description":"The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems.\r\n\r\nSecurity Fix(es):\n\n[Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt\nor iCCP decompression](CVE-2026-46675)","status":"published","published":"2026-10-16T12:00:09Z","modified":"2026-10-16T12:15:15.343847636Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4397","title":"libpng security update","description":"The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems.\r\n\r\nSecurity Fix(es):\n\n[Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt\nor iCCP decompression](CVE-2026-46675)","status":"published","published":"2026-10-16T12:00:10Z","modified":"2026-10-16T12:15:20.43039787Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4398","title":"libpng security update","description":"The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems.\r\n\r\nSecurity Fix(es):\n\n[Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt\nor iCCP decompression](CVE-2026-46675)","status":"published","published":"2026-10-16T12:00:10Z","modified":"2026-10-16T12:15:20.431374304Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4399","title":"libpng security update","description":"The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems.\r\n\r\nSecurity Fix(es):\n\n[Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt\nor iCCP decompression](CVE-2026-46675)","status":"published","published":"2026-10-16T12:00:11Z","modified":"2026-10-16T12:15:20.375626525Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"RHSA-2026:84420","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-18T10:05:16Z","modified":"2026-10-18T10:15:39.704899268Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"BELL-CVE-2026-46675","status":"published","published":"2026-09-30T17:58:32.696148Z","modified":"2026-10-02T07:15:03.584913896Z","updated_at":"2026-11-02T15:28:24.391068Z"},{"id":"CLSA-2026-1791824192","title":"Fix CVE(s): CVE-2026-46675","description":"   * SECURITY UPDATE: use-after-free through stale zstream pointers\n     - debian/patches/CVE-2026-46675.patch: add png_inflate_detach_buffers\n       to clear the zstream input and output pointers and counters, and\n       call it on claim in png_inflate_claim and on release in\n       png_decompress_chunk, png_handle_iCCP and png_read_finish_IDAT\n       (pngrutil.c), so that png_read_end called before row reading no\n       longer inflates through a stale next_in into a freed buffer\n     - CVE-2026-46675","status":"published","published":"2026-10-12T16:56:43Z","modified":"2026-10-26T09:32:06.357826352Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"DEBIAN-CVE-2026-46675","status":"published","published":"2026-09-29T15:47:25.694522903Z","modified":"2026-10-08T17:00:12.494401584Z","updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"MGASA-2026-0520","title":"Updated libpng package fixes a security vulnerability","description":"Use-after-free of zlib input in `png_read_end` after incomplete zTXt,\niTXt or iCCP decompression. (CVE-2026-46675)\n","status":"published","published":"2026-10-19T16:59:00Z","modified":"2026-10-19T17:00:03.588947453Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11984-1","title":"libpng16-16-1.6.59-1.1 on GA media","description":"These are all security issues fixed in the libpng16-16-1.6.59-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:28.091178548Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22084-1","title":"Security update for libpng16","description":"This update for libpng16 fixes the following issue:\n\n- CVE-2026-46675: Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression\n  (bsc#1283183).\n\nChanges for libpng16:\n\n- version update to 1.6.59:\n * Fixed CVE-2026-46675 (medium severity):\n Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt\n or iCCP decompression.\n (Reported independently by Ze Sheng and\n \u003cJasonHonKL@users.noreply.github.com\u003e.)\n * Fixed a regression introduced in version 1.6.47 that caused libpng to reject\n hIST chunks in their correct position, after PLTE.\n (Contributed by Yuki Sekiguchi.)\n * Prevented a double free of `png_struct` members after an allocation failure.\n (Contributed by Anthony Hurtado.)\n * Applied fixes and updates to the CMake build.\n * Adopted the REUSE Specification for licensing the CI files.\n","status":"published","published":"2026-10-10T11:20:30Z","modified":"2026-10-19T17:23:13.495133223Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24130-1","title":"Security update for libpng16","description":"This update for libpng16 fixes the following issue:\n\n- CVE-2026-46675: Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression\n  (bsc#1283183).\n\nChanges for libpng16:\n\n- version update to 1.6.59:\n * Fixed CVE-2026-46675 (medium severity):\n Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt\n or iCCP decompression.\n (Reported independently by Ze Sheng and\n \u003cJasonHonKL@users.noreply.github.com\u003e.)\n * Fixed a regression introduced in version 1.6.47 that caused libpng to reject\n hIST chunks in their correct position, after PLTE.\n (Contributed by Yuki Sekiguchi.)\n * Prevented a double free of `png_struct` members after an allocation failure.\n (Contributed by Anthony Hurtado.)\n * Applied fixes and updates to the CMake build.\n * Adopted the REUSE Specification for licensing the CI files.\n","status":"published","published":"2026-10-10T11:21:45Z","modified":"2026-10-13T17:23:10.196781686Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24228-1","title":"Security update for libpng16","description":"This update for libpng16 fixes the following issue:\n\n- CVE-2026-46675: Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression\n  (bsc#1283183).\n\nChanges for libpng16:\n\n- version update to 1.6.59:\n * Fixed CVE-2026-46675 (medium severity):\n Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt\n or iCCP decompression.\n (Reported independently by Ze Sheng and\n \u003cJasonHonKL@users.noreply.github.com\u003e.)\n * Fixed a regression introduced in version 1.6.47 that caused libpng to reject\n hIST chunks in their correct position, after PLTE.\n (Contributed by Yuki Sekiguchi.)\n * Prevented a double free of `png_struct` members after an allocation failure.\n (Contributed by Anthony Hurtado.)\n * Applied fixes and updates to the CMake build.\n * Adopted the REUSE Specification for licensing the CI files.\n","status":"published","published":"2026-10-10T11:21:45Z","modified":"2026-10-21T17:23:14.849097988Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4796-1","title":"Security update for libpng16","description":"This update for libpng16 fixes the following issue:\n\n- CVE-2026-46675: Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression\n  (bsc#1283183).\n\nChanges for libpng16:\n\n- version update to 1.6.59:\n * Fixed a regression introduced in version 1.6.47 that caused libpng to reject\n   hIST chunks in their correct position, after PLTE.\n * Prevented a double free of `png_struct` members after an allocation failure.\n * Applied fixes and updates to the CMake build.\n * Adopted the REUSE Specification for licensing the CI files.\n","status":"published","published":"2026-10-21T07:53:15Z","modified":"2026-10-21T20:02:15.032918849Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4801-1","title":"Security update for libpng16","description":"This update for libpng16 fixes the following issues:\n\n- CVE-2026-46675: Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression\n  (bsc#1283183).\n\nChanges for libpng16:\n\n- version update to 1.6.59 (jsc#PED-16190):\n * Fixed a regression introduced in version 1.6.47 that caused libpng to reject\n   hIST chunks in their correct position, after PLTE.\n * Prevented a double free of `png_struct` members after an allocation failure.\n * Applied fixes and updates to the CMake build.\n * Adopted the REUSE Specification for licensing the CI files.\n","status":"published","published":"2026-10-21T07:57:24Z","modified":"2026-10-21T20:02:15.442727508Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4814-1","title":"Security update for libpng16","description":"This update for libpng16 fixes the following issues:\n\n- CVE-2026-46675: Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression\n  (bsc#1283183).\n\nChanges for libpng16:\n\n- version update to 1.6.59 (jsc#PED-16190):\n * Fixed a regression introduced in version 1.6.47 that caused libpng to reject\n   hIST chunks in their correct position, after PLTE.\n * Prevented a double free of `png_struct` members after an allocation failure.\n * Applied fixes and updates to the CMake build.\n * Adopted the REUSE Specification for licensing the CI files.\n","status":"published","published":"2026-10-21T10:10:46Z","modified":"2026-10-21T20:02:14.077995319Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"UBUNTU-CVE-2026-46675","description":"[Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression]","status":"published","published":"2026-09-29T00:00:00Z","modified":"2026-10-08T19:47:11.894909838Z","updated_at":"2026-11-02T16:56:30.797112Z"},{"id":"USN-8899-1","title":"libpng1.6 vulnerability","description":"Ze Sheng discovered that libpng incorrectly handled certain compressed\ndata chunks in PNG files. An attacker could possibly use this issue to\ncause a denial of service.","status":"published","published":"2026-10-07T18:08:11Z","modified":"2026-10-09T01:57:55.202580124Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}