CVE-2026-33416 LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`

What is CVE-2026-33416?

CVE-2026-33416 is a high-severity use after free vulnerability in Libpng Libpng, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE` each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng 1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS` sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr` pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes the issue.

Weakness: CWE-416

Which versions are affected by CVE-2026-33416?

It affects 1 product.

Products include Libpng Libpng.

How do I fix CVE-2026-33416?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-33416 being exploited?

There is no known exploitation of CVE-2026-33416 in the wild and no public exploit code.

Other vulnerabilities in Libpng Libpng

• CVE-2017-12652 Denial of service in n/a Critical 9.8
• CVE-2018-14550 Out-of-bounds write in libpng High 8.8
• CVE-2026-25646 LIBPNG has a heap buffer overflow in png_set_quantize High 8.3
• CVE-2026-33636 LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64 High 7.6
• CVE-2016-10087 Null dereference in n/a High 7.5

All Libpng Libpng vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-33416, ALSA-2026:18028, ALSA-2026:18064, ALSA-2026:26347, ALSA-2026:26348, ALSA-2026:28244 and 53 more.