CVE-2026-34757 Use after free in libpng
Attackers can trigger a use-after-free in libpng setters to leak heap data or corrupt chunk metadata by passing freed pointers back to the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34757?
CVE-2026-34757 is a medium-severity use after free vulnerability in Debian Debian Linux, published on 9 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct). This vulnerability is fixed in 1.6.57.
Weakness: CWE-416
Which versions are affected by CVE-2026-34757?
It affects 2 products.
Linux distribution packages (11)
libpng Red Hat:hummingbird:1 | All versions | 0:1.6.57-0.1.hum1 |
libpng-devel Red Hat:hummingbird:1 | All versions | 0:1.6.57-0.1.hum1 |
libpng-static Red Hat:hummingbird:1 | All versions | 0:1.6.57-0.1.hum1 |
libpng-tools Red Hat:hummingbird:1 | All versions | 0:1.6.57-0.1.hum1 |
libpng16 SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.6.40-150600.3.20.1 |
libpng16 SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 1.6.8-15.24.1 |
libpng16 SUSE:Linux Micro 6.0 | All versions | 1.6.43-5.1 |
libpng16 SUSE:Linux Micro 6.1 | All versions | 1.6.43-slfo.1.1_5.1 |
libpng16 SUSE:Linux Micro 6.2 | All versions | 1.6.44-160000.7.1 |
libpng16 openSUSE:Leap 16.0 | All versions | 1.6.44-160000.7.1 |
libpng16 openSUSE:Tumbleweed | All versions | 1.6.57-1.1 |
Products include Debian Debian Linux, Libpng Libpng.
How do I fix CVE-2026-34757?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-34757 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34757 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2026-34757, AZL-82643, AZL-85478, AZL-85481, AZL-85484, AZL-85487 and 25 more.