https://seclists.org/oss-sec/2026/q3/977: libpng 1.6.59: Use-after-fe vulnerability fixed: CVE-2026-46675

Q: Which applications are exposed to this issue?

Applications using libpng versions 1.6.0 through 1.6.58 are affected only if they call png_read_end before beginning to read image rows. The vulnerable path involves incomplete decompression of crafted zTXt, iTXt, or iCCP chunks.

Q: What does an attacker need to provide to trigger the vulnerability?

An attacker needs a crafted PNG containing a zTXt, iTXt, or iCCP chunk that causes libpng to abandon decompression while zlib still expects input. Examples include an invalid zlib window size, decompressed data exceeding libpng limits, or an ICC profile that fails validation.

Q: Is exploitation remote and does it require authentication or user interaction?

The provided CVSS vector rates the issue as network-accessible with no privileges or user interaction required, but with high attack complexity. Its stated impact is availability only, with high availability impact and no confidentiality or integrity impact.

Q: What should be done if upgrading is not immediately possible?

Apply the referenced fix commit aa77ef38c17ab2fc1b41bec09fb973c6a386641d. Otherwise, avoid the affected usage pattern of calling png_read_end before starting to read image rows.

Published Sep 29, 2026

Updated

Affected Software

1 affected component

libpng LIBPNG>=1.6.0<=1.6.58

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using libpng versions 1.6.0 through 1.6.58 are affected only if they call png_read_end before beginning to read image rows. The vulnerable path involves incomplete decompression of crafted zTXt, iTXt, or iCCP chunks.

What does an attacker need to provide to trigger the vulnerability?

An attacker needs a crafted PNG containing a zTXt, iTXt, or iCCP chunk that causes libpng to abandon decompression while zlib still expects input. Examples include an invalid zlib window size, decompressed data exceeding libpng limits, or an ICC profile that fails validation.

Is exploitation remote and does it require authentication or user interaction?

The provided CVSS vector rates the issue as network-accessible with no privileges or user interaction required, but with high attack complexity. Its stated impact is availability only, with high availability impact and no confidentiality or integrity impact.

What should be done if upgrading is not immediately possible?

Apply the referenced fix commit aa77ef38c17ab2fc1b41bec09fb973c6a386641d. Otherwise, avoid the affected usage pattern of calling png_read_end before starting to read image rows.