Heap Use-After-Free Vulnerability in LIBPNG Affects Multiple Versions
CVE-2026-33416

7.5HIGH

Key Information:

Vendor: Pnggroup
Status: Libpng
Vendor: CVE Published:; 26 March 2026

What is CVE-2026-33416?

CVE-2026-33416 is a heap use-after-free vulnerability found in the LIBPNG library, which is a widely-used reference library for processing PNG (Portable Network Graphics) image files. This vulnerability affects versions 1.2.1 through 1.6.55 of LIBPNG. The issue arises due to the improper handling of memory allocation between the png_struct and png_info structures during the use of functions png_set_tRNS and png_set_PLTE. Specifically, these functions alter a shared heap-allocated buffer without properly managing memory lifetimes, leading to potential memory corruption. If exploited, this vulnerability can allow attackers to execute arbitrary code or cause application crashes, significantly impacting an organization's image processing capabilities and overall software stability.

Potential impact of CVE-2026-33416

Exploitation of Arbitrary Code Execution: The vulnerability could be exploited to execute arbitrary code in the context of the affected application. This poses a severe threat, especially for applications that rely on LIBPNG for handling image files, as attackers could manipulate images to gain unauthorized control over the system.
Application Crashes and Denial of Service: The memory corruption associated with this vulnerability can lead to application crashes. If software that uses LIBPNG becomes unreliable or completely inoperable, businesses relying on this functionality may experience significant disruptions in their operations.
Data Integrity Risks: Since the vulnerability allows for manipulation of memory, there’s a risk that it could be used to alter images processed by the affected library. Such tampering could compromise data integrity, leading to incorrect image rendering or processing and undermining trust in data outputs.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch