CVE-2026-33636 LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64

High 7.6 Published 26 Mar 2026 Updated 26 Mar 2026

An out-of-bounds read and write in libpng's ARM NEON palette expansion allows attackers to execute code or cause denial of service via crafted PNG files.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-33636?

CVE-2026-33636 is a high-severity memory corruption vulnerability in Libpng Libpng, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without verifying that enough input pixels remain. Because the implementation works backward from the end of the row, the final iteration dereferences pointers before the start of the row buffer (OOB read) and writes expanded pixel data to the same underflowed positions (OOB write). This is reachable via normal decoding of attacker-controlled PNG input if Neon is enabled. Version 1.6.56 fixes the issue.

Weakness: CWE-787, CWE-125

Which versions are affected by CVE-2026-33636?

It affects 1 product.

Linux distribution packages (37)

`libpng` AlmaLinux:10	All versions	`2:1.6.40-8.el10_1.3`
`libpng-devel` AlmaLinux:10	All versions	`2:1.6.40-8.el10_1.3`
`libpng` AlmaLinux:9	All versions	`2:1.6.37-12.el9_7.3`
`libpng-devel` AlmaLinux:9	All versions	`2:1.6.37-12.el9_7.3`
`libpng` Red Hat:enterprise_linux:10.1	All versions	`2:1.6.40-8.el10_1.3`
`libpng-debuginfo` Red Hat:enterprise_linux:10.1	All versions	`2:1.6.40-8.el10_1.3`
`libpng-debugsource` Red Hat:enterprise_linux:10.1	All versions	`2:1.6.40-8.el10_1.3`
`libpng-devel` Red Hat:enterprise_linux:10.1	All versions	`2:1.6.40-8.el10_1.3`
`libpng-devel-debuginfo` Red Hat:enterprise_linux:10.1	All versions	`2:1.6.40-8.el10_1.3`
`libpng-tools-debuginfo` Red Hat:enterprise_linux:10.1	All versions	`2:1.6.40-8.el10_1.3`
`libpng` Red Hat:enterprise_linux:9::appstream	All versions	`2:1.6.37-12.el9_7.3`
`libpng-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`2:1.6.37-12.el9_7.3`
`libpng-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`2:1.6.37-12.el9_7.3`
`libpng-devel` Red Hat:enterprise_linux:9::appstream	All versions	`2:1.6.37-12.el9_7.3`
`libpng-devel-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`2:1.6.37-12.el9_7.3`
`libpng-tools-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`2:1.6.37-12.el9_7.3`
`libpng` Red Hat:enterprise_linux:9::baseos	All versions	`2:1.6.37-12.el9_7.3`
`libpng-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`2:1.6.37-12.el9_7.3`
`libpng-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`2:1.6.37-12.el9_7.3`
`libpng-devel-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`2:1.6.37-12.el9_7.3`
`libpng-tools-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`2:1.6.37-12.el9_7.3`
`libpng` Red Hat:enterprise_linux_eus:10.0	All versions	`2:1.6.40-8.el10_0.3`
`libpng-devel` Red Hat:enterprise_linux_eus:10.0	All versions	`2:1.6.40-8.el10_0.3`
`libpng` Red Hat:rhel_e4s:9.0::appstream	All versions	`2:1.6.37-12.el9_0.3`
`libpng-devel` Red Hat:rhel_e4s:9.0::appstream	All versions	`2:1.6.37-12.el9_0.3`
`libpng` Red Hat:rhel_e4s:9.0::baseos	All versions	`2:1.6.37-12.el9_0.3`
`libpng` Red Hat:rhel_e4s:9.2::appstream	All versions	`2:1.6.37-12.el9_2.3`
`libpng-devel` Red Hat:rhel_e4s:9.2::appstream	All versions	`2:1.6.37-12.el9_2.3`
`libpng` Red Hat:rhel_e4s:9.2::baseos	All versions	`2:1.6.37-12.el9_2.3`
`libpng` Red Hat:rhel_eus:9.4::appstream	All versions	`2:1.6.37-12.el9_4.3`
`libpng-devel` Red Hat:rhel_eus:9.4::appstream	All versions	`2:1.6.37-12.el9_4.3`
`libpng` Red Hat:rhel_eus:9.4::baseos	All versions	`2:1.6.37-12.el9_4.3`
`libpng` Red Hat:rhel_eus:9.6::appstream	All versions	`2:1.6.37-12.el9_6.3`
`libpng-devel` Red Hat:rhel_eus:9.6::appstream	All versions	`2:1.6.37-12.el9_6.3`
`libpng` Red Hat:rhel_eus:9.6::baseos	All versions	`2:1.6.37-12.el9_6.3`
`libpng` Rocky Linux:10	All versions	`2:1.6.40-8.el10_1.3`
`libpng` Rocky Linux:9	All versions	`2:1.6.37-12.el9_7.3`

Products include Libpng Libpng.

How do I fix CVE-2026-33636?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-33636 being exploited?

There is no known exploitation of CVE-2026-33636 in the wild and no public exploit code.

All Libpng Libpng vulnerabilities

Sources

Also known as A-496616027, ALPINE-CVE-2026-33636, ALSA-2026:14790, ALSA-2026:14791, ASB-A-496616027, AZL-80993 and 20 more.