CVE-2026-34757

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct). This vulnerability is fixed in 1.6.57.

• CWE-416

• https://github.com/pnggroup/libpng/commit/398cbe3df03f4e11bb031e07f416dfdde3684e8aPatch
• https://github.com/pnggroup/libpng/commit/55d20aaa322c9274491cda82c5cd4f99b48c6bccPatch
• https://github.com/pnggroup/libpng/issues/836Exploit, Issue Tracking, Mitigation
• https://github.com/pnggroup/libpng/issues/837Exploit, Issue Tracking, Mitigation
• https://github.com/pnggroup/libpng/security/advisories/GHSA-6fr7-g8h7-v645Mitigation, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2026/05/msg00017.htmlMailing List, Third Party Advisory

Published

Apr 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34751Payload is a free and open source headless content managemen…9.1
• CVE-2026-34752Haraka is a Node.js mail server. Prior to version 3.1.4, sen…7.5
• CVE-2026-34753vLLM is an inference and serving engine for large language m…5.4
• CVE-2026-34754Mantis Bug Tracker (MantisBT) is an open source issue tracke…4.3
• CVE-2026-34755vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-34756vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-34758OneUptime is an open-source monitoring and observability pla…9.1
• CVE-2026-34759OneUptime is an open-source monitoring and observability pla…8.1
• CVE-2026-3476A Code Injection vulnerability affecting SOLIDWORKS Desktop …7.8
• CVE-2026-34760vLLM is an inference and serving engine for large language m…7.1
• CVE-2026-34761Ella Core is a 5G core designed for private networks. Prior …6.5
• CVE-2026-34762Ella Core is a 5G core designed for private networks. Prior …2.7