CVE-2026-34757 Details
Description
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct). This vulnerability is fixed in 1.6.57.
A use-after-free vulnerability has been identified in libpng, a library for handling PNG image files. This issue affects versions 1.0.9 prior to 1.6.57. The vulnerability arises when pointers obtained from the getters for PLTE, tRNS, or hIST are passed back into the corresponding setters on the same png_struct/png_info pair. The setters read from freed memory, leading to the potential corruption of chunk metadata or the leakage of unrelated heap data into the chunk structure. The vulnerability can be exploited by following a 'get, inspect, set' pattern with the chunk getters and setters.
The vulnerability has been fixed in libpng version 1.6.57. Applications should also be updated to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2026/05/msg00017.html | CVE | Mailing ListThird Party Advisory |
| https://github.com/pnggroup/libpng/commit/398cbe3df03f4e11bb031e07f416dfdde3684e8a | [email protected] | Patch |
| https://github.com/pnggroup/libpng/commit/55d20aaa322c9274491cda82c5cd4f99b48c6bcc | [email protected] | Patch |
| https://github.com/pnggroup/libpng/issues/836 | [email protected] | ExploitIssue TrackingMitigation |
| https://github.com/pnggroup/libpng/issues/837 | [email protected] | ExploitIssue TrackingMitigation |
| https://github.com/pnggroup/libpng/security/advisories/GHSA-6fr7-g8h7-v645 | [email protected] | MitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libpng libpng | >= 1.0.9, < 1.6.57 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | Initial Analysis | [email protected] |
| May 9, 2026 | CVE Modified | CVE |
| Apr 9, 2026 | New CVE Received | [email protected] |