Memory Corruption Vulnerability in LIBPNG by PNG Group

CVE-2026-34757

What is CVE-2026-34757?

LIBPNG, a widely used reference library for handling PNG (Portable Network Graphics) files, has a critical issue affecting its versions prior to 1.6.57. A flaw exists where pointers obtained from functions such as png_get_PLTE, png_get_tRNS, or png_get_hIST can be incorrectly used in related setter functions. This leads to reading from previously freed memory, which may result in data corruption or leakage of sensitive information. Users are advised to update to version 1.6.57 or later to mitigate potential risks related to stale data and memory management errors.

References