RLSA-2026:99225: Moderate: mingw-libpng security update

Q: Which systems should be prioritized for review?

Review Rocky Linux systems that have any of the listed MinGW libpng packages installed: mingw32-libpng, mingw32-libpng-debuginfo, mingw32-libpng-static, mingw64-libpng, mingw64-libpng-debuginfo, or mingw64-libpng-static.

Q: What conditions does exploitation require?

The CVSS vector indicates the issue is network-reachable, requires high attack complexity, does not require privileges, and requires user interaction. Successful exploitation can affect confidentiality, integrity, and availability.

Q: How can I determine whether a system may be affected?

Check installed package inventories for the affected MinGW 32-bit or 64-bit libpng package names, including static and debuginfo variants. The advisory data does not provide affected or fixed package version numbers.

Published Nov 13, 2026

Updated

MinGW Windows Libpng library.

Security Fix(es):

libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

6 affected componentsFixes available

rocky-linux/mingw32-libpng<0:1.6.34-3.el8_10

0:1.6.34-3.el8_10

rocky-linux/mingw32-libpng-debuginfo<0:1.6.34-3.el8_10

0:1.6.34-3.el8_10

rocky-linux/mingw32-libpng-static<0:1.6.34-3.el8_10

0:1.6.34-3.el8_10

rocky-linux/mingw64-libpng<0:1.6.34-3.el8_10

0:1.6.34-3.el8_10

rocky-linux/mingw64-libpng-debuginfo<0:1.6.34-3.el8_10

0:1.6.34-3.el8_10

rocky-linux/mingw64-libpng-static<0:1.6.34-3.el8_10

0:1.6.34-3.el8_10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/mingw32-libpng to a version that resolves this vulnerability.
Fixed in 0:1.6.34-3.el8_10
Upgrade
Upgrade rocky-linux/mingw32-libpng-debuginfo to a version that resolves this vulnerability.
Fixed in 0:1.6.34-3.el8_10
Upgrade
Upgrade rocky-linux/mingw32-libpng-static to a version that resolves this vulnerability.
Fixed in 0:1.6.34-3.el8_10
Upgrade
Upgrade rocky-linux/mingw64-libpng to a version that resolves this vulnerability.
Fixed in 0:1.6.34-3.el8_10
Upgrade
Upgrade rocky-linux/mingw64-libpng-debuginfo to a version that resolves this vulnerability.
Fixed in 0:1.6.34-3.el8_10
Upgrade
Upgrade rocky-linux/mingw64-libpng-static to a version that resolves this vulnerability.
Fixed in 0:1.6.34-3.el8_10

Event History

Nov 13, 2026

Advisory Published

via OSV·06:02 AM

Data Sourced

via OSV·06:02 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-33416

Frequently Asked Questions

Which systems should be prioritized for review?

Review Rocky Linux systems that have any of the listed MinGW libpng packages installed: mingw32-libpng, mingw32-libpng-debuginfo, mingw32-libpng-static, mingw64-libpng, mingw64-libpng-debuginfo, or mingw64-libpng-static.

What conditions does exploitation require?

The CVSS vector indicates the issue is network-reachable, requires high attack complexity, does not require privileges, and requires user interaction. Successful exploitation can affect confidentiality, integrity, and availability.

How can I determine whether a system may be affected?

Check installed package inventories for the affected MinGW 32-bit or 64-bit libpng package names, including static and debuginfo variants. The advisory data does not provide affected or fixed package version numbers.

RLSA-2026:99225: Moderate: mingw-libpng security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems should be prioritized for review?

What conditions does exploitation require?

How can I determine whether a system may be affected?

Company

Resources

Contact