https://seclists.org/oss-sec/2026/q4/156: libpng 1.6.59: Use-after-fe vulnerability fixed: CVE-2026-46675

Q: Which applications are exposed to this vulnerability?

Applications using libpng's sequential reader are affected if they call png_read_end before starting to read image rows. The issue has been present since libpng 1.6.0.

Q: What must an attacker be able to trigger?

An attacker would need to cause an application to reach the affected sequential-reader code path where png_read_end is called without image-row reading having started. The provided information does not describe a specific file or input condition beyond that application behavior.

Q: What should teams do if they are affected?

Upgrade to libpng 1.6.59 or apply the fix described in the release announcement. Review uses of the sequential reader for calls to png_read_end that can occur before reading image rows.

Published Oct 14, 2026

Updated

Affected Software

1 affected component

libpng LIBPNG>=1.6.0<1.6.59

Frequently Asked Questions

Which applications are exposed to this vulnerability?

Applications using libpng's sequential reader are affected if they call png_read_end before starting to read image rows. The issue has been present since libpng 1.6.0.

What must an attacker be able to trigger?

An attacker would need to cause an application to reach the affected sequential-reader code path where png_read_end is called without image-row reading having started. The provided information does not describe a specific file or input condition beyond that application behavior.

What should teams do if they are affected?

Upgrade to libpng 1.6.59 or apply the fix described in the release announcement. Review uses of the sequential reader for calls to png_read_end that can occur before reading image rows.