https://seclists.org/oss-sec/2026/q1/387: libpng 1.6.56: Two high-severity vulnerabilities fixed: CVE-2026-33416, CVE-2026-33636
Published Mar 25, 2026
·Updated
Affected Software
1 affected component
libpng LIBPNG<=1.6.55, >=1.6.36<=1.6.55
Frequently Asked Questions
1
What is the severity of CVE-2026-33416?
CVE-2026-33416 is classified as a high-severity vulnerability due to its use-after-free issue in the low-level API.
2
What is the severity of CVE-2026-33636?
CVE-2026-33636 is also a high-severity vulnerability, which involves an out-of-bounds read/write in the ARM Neon palette expansion.
3
How do I fix CVE-2026-33416?
To fix CVE-2026-33416, users should upgrade to libpng version 1.6.56 or later.
4
How do I fix CVE-2026-33636?
CVE-2026-33636 can be fixed by upgrading to libpng version 1.6.56 or later, as it addresses the out-of-bounds read/write issue.
5
Which versions of libpng are affected by CVE-2026-33636?
CVE-2026-33636 affects libpng versions 1.6.36 through 1.6.55.