CVE-2026-58936

None

CVSS

—

EPSS

0.2%

Published

Nov 2, 2026

CISA due date

—

The record

In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected packages

Ecosystem	Package	Introduced	Fixed