CVE-2026-33416

What it actually does

CVE-2026-33416 is a use-after-free flaw in libpng versions 1.2.1 through 1.6.55 involving the PNG transparency and palette APIs. `png_set_tRNS` and `png_set_PLTE` can cause `png_struct` and `png_info` to share the same heap allocation while maintaining independent lifetimes. When `png_free_data` is called with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`, or when these setter functions are called again and internally free prior data, the allocation can be freed through `png_info` while `png_struct` retains a dangling pointer. Later PNG row-transformation code may read from or write to that freed memory. In vulnerable applications that process attacker-controlled PNG data and exercise the affected API paths, this can lead to heap corruption, process crashes, information disclosure, or potentially arbitrary code execution depending on allocator behavior, compiler hardening, and application context.

Why it matters to the business

Applications, services, desktop software, mobile apps, media pipelines, document processors, image upload workflows, and embedded products that rely on vulnerable libpng versions may be exposed when they process untrusted PNG files. Successful exploitation could disrupt image-processing services, crash user-facing applications, leak sensitive process memory, or in the worst case allow code execution in the context of the vulnerable process. The issue is not currently listed in CISA KEV, has no known public exploit maturity in the provided data, and has a low EPSS score with no 30-day increase, but libpng is a widely reused dependency and the defect has existed across many release lines, so exposure may be broad through direct and transitive dependencies.

How an attack unfolds

An attacker first identifies software that accepts or processes PNG images using a vulnerable libpng release. The attacker then crafts a PNG or a PNG-processing workflow that causes the application to invoke the affected transparency or palette handling paths, particularly `png_set_tRNS`, `png_set_PLTE`, or cleanup through `png_free_data` with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`. The vulnerable code frees a heap buffer through one libpng structure while another structure still retains a pointer to the same allocation. When subsequent row transforms or repeated setter calls use that dangling pointer, the process dereferences freed memory. At minimum, this can produce a controlled crash and denial of service. With precise heap shaping and favorable runtime conditions, an attacker may be able to influence freed memory contents and turn the memory corruption into information disclosure or code execution, although exploitation is high complexity and requires user interaction or a service action that processes the malicious PNG.

How to fix it

Upgrade libpng to version 1.6.56 or later wherever it is used directly or bundled into applications, appliances, containers, language bindings, SDKs, or operating-system packages. Because the provided fixed-version list is empty but the advisory description identifies 1.6.56 as the fix, treat 1.6.56 as the minimum safe upstream release unless a downstream vendor has backported the patch to an older package version. Rebuild statically linked software and container images that embed libpng, not just systems with dynamically linked packages. If immediate upgrade is not possible, reduce exposure by disabling untrusted PNG processing, isolating image conversion or thumbnailing workers in sandboxed low-privilege processes, applying memory-safety hardening where available, limiting file upload size and type handling, and routing image processing through patched services only. Monitor vendor advisories for OS distributions and application products that ship backported fixes under distro-specific version numbers.

How to confirm the fix worked

Confirm exposure by inventorying libpng versions from package managers, software composition analysis, container image scans, SBOMs, and application dependency manifests. Validate that all direct and bundled copies report libpng 1.6.56 or a vendor-backported fixed build. For dynamically linked binaries, inspect runtime linkage with tools such as `ldd`, `otool -L`, package metadata, or equivalent platform tooling to ensure the patched library is actually loaded. For statically linked applications, rebuild and rescan binaries or SBOMs to confirm the vulnerable code is no longer embedded. Functional validation should include regression tests that parse and transform PNG images with palette and transparency chunks. Security validation can include AddressSanitizer or allocator-hardening test runs against crafted PNG corpora to confirm no `png_set_tRNS`, `png_set_PLTE`, or `png_free_data` use-after-free reports remain.

Typical attack path

1. Find a target application, service, or processing pipeline that uses libpng versions 1.2.1 through 1.6.55.
2. Deliver or upload a crafted PNG file, or otherwise cause the target to process attacker-controlled PNG image data.
3. Trigger libpng palette or transparency handling that invokes `png_set_tRNS`, `png_set_PLTE`, or `png_free_data` with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`.
4. Cause the shared heap allocation to be freed while a corresponding pointer in `png_struct` remains dangling.
5. Trigger subsequent row transformation or repeated setter behavior that reads from or writes to the freed allocation.
6. Achieve process crash, memory disclosure, or potentially code execution depending on heap layout, mitigations, and application privileges.

How to detect it

Detecting prior exploitation is difficult because the vulnerability is memory corruption in a common image library and successful attacks may leave only application crashes or generic heap-corruption artifacts. Review logs, crash dumps, core files, endpoint telemetry, and observability traces from services that process PNG files for segmentation faults, aborts, allocator corruption, or sanitizer findings with stack traces containing `png_set_tRNS`, `png_set_PLTE`, `png_free_data`, `png_do_read_transformations`, or other libpng row-transform routines. Correlate crashes with recent PNG uploads, thumbnail generation, document conversion, media ingestion, messaging attachments, web requests with `image/png` content, or files containing PNG palette (`PLTE`) and transparency (`tRNS`) chunks. In EDR data, look for unexpected child processes, shell execution, network connections, or file writes originating from image-processing services shortly after PNG handling crashes, as those may indicate exploitation beyond denial of service. Preserve suspicious PNG samples, core dumps, allocator logs, and request metadata for forensic analysis. If AddressSanitizer, hardened malloc, Windows Error Reporting, systemd-coredump, macOS crash reports, or application crash collectors are available, search them specifically for libpng use-after-free and heap corruption signatures.

• AddressSanitizer: heap-use-after-free
• heap-use-after-free in png_set_tRNS
• heap-use-after-free in png_set_PLTE
• heap-use-after-free in png_free_data
• png_set_tRNS
• png_set_PLTE
• png_free_data
• PNG_FREE_TRNS
• PNG_FREE_PLTE
• png_do_read_transformations
• png_do_expand_palette
• Segmentation fault.*libpng
• SIGSEGV.*libpng
• SIGABRT.*libpng
• double free or corruption
• malloc(): unaligned tcache chunk detected
• malloc(): memory corruption
• corrupted size vs. prev_size
• free(): invalid pointer
• image/png

What your security team should do

• Prioritize upgrading internet-facing, automated, or multi-tenant image-processing paths that accept untrusted PNG files.
• Identify both direct and transitive libpng usage through SBOMs, dependency scans, package inventories, and container image scans; include statically linked and vendor-bundled copies.
• Upgrade to libpng 1.6.56 or a vendor-confirmed backport, then rebuild and redeploy affected applications and containers.
• Temporarily sandbox image-processing workers, restrict privileges, and isolate file conversion pipelines until patching is complete.
• Add crash and memory-corruption monitoring for services that process PNG files, especially crashes involving `png_set_tRNS`, `png_set_PLTE`, `png_free_data`, or libpng row transformation routines.
• Review recent unexplained crashes, segmentation faults, allocator corruption events, and AddressSanitizer findings in image-processing components for possible exploitation attempts.
• Because exploit maturity is currently reported as none and EPSS is low and flat, handle as a broad dependency hygiene and exposure-reduction priority rather than an emergency KEV-driven response, unless the affected service is highly exposed or processes attacker-supplied images at scale.