Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE` each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng 1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS` sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr` pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-26 | 2 | General1Patch1 |
| 2026-03-27 | 2 | General2 |
| 2026-03-28 | 1 | Patch1 |
| 2026-03-30 | 2 | Disclosure2 |
| 2026-04-01 | 1 | General1 |
| 2026-04-07 | 1 | Disclosure1 |
| 2026-04-15 | 1 | Disclosure1 |
| 2026-04-16 | 1 | Patch1 |
| 2026-08-12 | 2 | General2 |
| 2026-09-20 | 1 | PoC1 |
自作 AddressSanitizer で libpng の CVE-2026-33416 を検証できたぞ！ #seccamp https://t.co/NxcIJ6wcds
Post summary
The tweet confirms that the author verified libpng CVE-2026-33416 using a custom AddressSanitizer but does not provide a PoC, exploit code, or patch information.
2 CVEs in libpng https://www.openwall.com/lists/oss-security/2026/03/26/1 libpng 1.6.56 has been released, fixing two high-severity CVEs CVE-2026-33416: Use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE CVE-2026-33636: Out-of-bounds read/write in the palette expansion on ARM Neon
Post summary
Two high‑severity CVEs affecting libpng have been addressed in version 1.6.56, with detailed technical information about use‑after‑free and out‑of‑bounds read/write vulnerabilities.
libpngの脆弱性(CVE-2026-33416)、四半世紀近くよく見つからなかったね・・・。Cではよくある「誰がそのメモリを解放してよいか」が曖昧だったためのUse-After-Free問題っぽい。条件が限定的で、libpngでPNGファイルを読んでたら即アウトみたいなものではないのが救い。
Post summary
The post mentions CVE‑2026‑33416 as a use‑after‑free in libpng with limited conditions but provides no proof of exploitation, code, or patch information.
@girlkisserwx @rebane2001 @1lexxi @itzsagka No need for a RCE on google. He opened the downloaded PNG. Just this year there was libpng CVE that allowed PNGs to act as exploit primitive/RCE (CVE-2026-33416). Libpng is an open source project plus Microsoft awful vuln reporting program yields no monetary incentive to disclose
Post summary
The tweet references libpng CVE‑2026‑33416 that enables RCE through PNG files, but no PoC, exploit tool, patch, or evidence of active exploitation is provided.
以前買ったドメインずっと雑なWebを立ててたのでブログみたいなものを書いてみた。 過去に発見した脆弱性を簡単に整理してPoCも確認し直した。 https://smddd.net/blog/CVE-2026-33416/
Post summary
The author shares a blog post revisiting previously discovered vulnerabilities and rechecking the PoC for CVE-2026-33416. No exploit tool, patch, or active exploitation details are mentioned in the tweet text itself.
Researchers reveal critical RCE and ARM-specific flaws in libpng (CVE-2026-33636 & 33416). Affecting decades of apps, these bugs require an immediate update. #libpng #CyberSecurity #RCE #InfoSec #ARM #Vulnerability #PatchNow #ImageProcessing #Exploit https://securityonline.info/libpng-vulnerability-rce-arm-neon-cve-2026-33636-cve-2026-33416/ https://t.co/DIPnyGnutN
Post summary
Researchers disclosed two critical RCE vulnerabilities in libpng that affect legacy applications and call for urgent updates, but no evidence of active exploitation or published exploit code is presented.
CVE-2026-33416 libpng 1.6.56 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33416
Post summary
The text supplies a CVE identifier and a link to a vulnerability database entry but offers no technical or operational details.
PNG ライブラリ libpng の脆弱性 CVE-2026-33416／33636 が FIX：クラッシュと情報漏洩の恐れ https://iototsecnews.jp/2026/03/31/png-vulnerabilities-allow-attackers-to-trigger-crashes-and-leak-sensitive-data/ 画像処理の基盤として広く使われている PNG ライブラリ libpng に発見された、2 件の深刻な脆弱性について解説する記事です。 これらの問題の原因は、メモリ管理の不備と、高速化のためのプログラム処理における境界チェックの不足にあります。 1 つ目の脆弱性 CVE-2026-33416 (CVSS 8.1) は、画像の透過情報やパレット情報を扱う際のメモリの二重管理に起因します。 2 つ目の脆弱性 CVE-2026-33636 (CVSS 7.1) は、ARM プロセッサ向けの高速化機能 (Neon) を使っている場合に発生します。 ご利用のチームは、ご注意ください。 #CVE202633416 #CVE202633636 #libpng #Vulnerability
Post summary
The news article discloses two severe libpng vulnerabilities (CVE‑2026‑33416 and CVE‑2026‑33636), explains their root causes, and provides CVSS scores, but offers no information on patches, exploits, or active attacks.
The 30-Year Glitch: RCE and ARM Exploits Uncovered in libpng Reference Library https://securityonline.info/libpng-vulnerability-rce-arm-neon-cve-2026-33636-cve-2026-33416/
Post summary
The article announces that RCE and ARM exploits have been uncovered in the libpng reference library, citing two new CVEs and providing a link for additional details.
Disponible LibPNG 1.6.56 en ALDOS, corrigiendo vulnerabilidades CVE-2026-33416 y CVE-2026-33636 vía @darkshram https://www.alcancelibre.org/noticias/disponible-libpng-1-6-56-en-aldos-corrigiendo-vulnerabilidades-cve-2026-33416-y-cve-2026-33636
Post summary
ALDOS has released LibPNG 1.6.56, which resolves CVE-2026-33416 and CVE-2026-33636, with credit attributed to @darkshram.
Firefox hit by another infinite script execution DoS (CVE-2026-33416). Instead of panic-updating, here's a bash script that checks, patches, OR blocks it with iptables. Works on Ubuntu, Rocky, SUSE. Save this. You'll need it again. Read more: 👉 https://tinyurl.com/3yxtbm8w https://t.co/5QmAHyaTZA
Post summary
The post provides a bash-based mitigation script for CVE‑2026‑33416 and does not claim active exploitation or supply exploit code, focusing on patching/locking down the vulnerability.
🚨 New HIGH CVE detected in AWS Lambda 🚨 CVE-2026-33416 impacts libpng in 6 Lambda base images. Details: https://github.com/aws/aws-lambda-base-images/issues/474 More: https://lambdawatchdog.com/ #AWS #Lambda #CVE #CloudSecurity #Serverless
Post summary
The tweet announces a newly detected HIGH severity CVE affecting libpng in AWS Lambda base images, offering minimal technical details and linking to the issue discussion.
🚨*CVE* CVE-2026-33416 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through … https://www.cve.org/CVERecord?id=CVE-2026-33416 ----- Traducción: CVE-2026-33416 LIB… http://infoflow.cloud`
Post summary
The post merely references CVE-2026-33416 for LIBPNG and links to the CVE record, without providing further technical or exploit information.
CVE-2026-33416 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through … https://www.cve.org/CVERecord?id=CVE-2026-33416
Post summary
The snippet briefly references CVE-2026-33416 affecting LIBPNG but provides no further technical details or actionable information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | libpng | libpng | - | - | - |