CVE-2019-7317

What it actually does

png_image_free in png.c triggers a use-after-free because png_image_free_function executes under png_safe_execute, allowing memory corruption during PNG image handling.

Why it matters to the business

Applications processing PNG images face elevated risk of crashes or denial-of-service; the issue affects MySQL server builds and remains exploitable years after disclosure with publicly available code.

How an attack unfolds

An attacker supplies a crafted PNG to a vulnerable libpng instance inside an affected MySQL server or dependent application; the malformed image triggers the unsafe free path during decoding, resulting in memory corruption that can be leveraged for denial of service or further exploitation.

How to fix it

Upgrade mysql/mysql-server (GIT) to commit 7ed30a748964c009d4909cb8b4b22036ebdef239 or later; rebuild any dependent components that statically link libpng 1.6.x before 1.6.37.

How to confirm the fix worked

Confirm the running binary no longer contains the vulnerable png_image_free implementation by inspecting the updated commit or by testing against known triggering PNG samples.

Typical attack path

1. Identify a network-accessible service that parses PNG images using the vulnerable libpng version
2. Craft and deliver a malicious PNG payload that exercises the png_image_free path
3. Trigger the use-after-free condition during safe-execute cleanup
4. Leverage resulting memory state for denial of service or sandbox escape

How to detect it

Review application and server logs for unexpected crashes or memory errors during PNG processing; correlate with inbound image uploads or database operations that handle graphics.

What your security team should do

• Apply the listed commit immediately given the public exploit availability and long disclosure window
• Scan all build pipelines and containers for older libpng 1.6.x versions
• Add PNG parsing to the list of high-risk inputs monitored by application security testing