Out-of-Bounds Read and Write Vulnerability in libpng for ARM/AArch64

CVE-2026-33636

What is CVE-2026-33636?

The libpng library, utilized for processing PNG files, contains an out-of-bounds read and write vulnerability in its Neon-optimized palette expansion path. This issue occurs in versions 1.6.36 through 1.6.55 when expanding 8-bit paletted rows to RGB or RGBA. A flaw allows a Neon loop to process a partial chunk without adequate verification of input pixel availability, which results in the possibility of dereferencing pointers beyond the start of a row buffer. Consequently, the implementation may write to incorrect memory locations, posing risks for normal decoding of attacker-supplied PNG inputs with Neon enabled. The problem has been resolved in version 1.6.56.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References