CVE-2026-33636

CVE Details

Release Date:	2026-03-26
Impact:	Moderate	What is this?

Description

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without verifying that enough input pixels remain. Because the implementation works backward from the end of the row, the final iteration dereferences pointers before the start of the row buffer (OOB read) and writes expanded pixel data to the same underflowed positions (OOB write). This is reachable via normal decoding of attacker-controlled PNG input if Neon is enabled. Version 1.6.56 fixes the issue.

See more information about CVE-2026-33636 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	7.6
Vector String:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Version:	3.1
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	Required
Scope:	Unchanged
Confidentiality Impact:	Low
Integrity Impact:	Low
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 10 (firefox)	ELSA-2026-7672	2026-04-13
Oracle Linux version 8 (firefox)	ELSA-2026-8052	2026-04-14
Oracle Linux version 9 (firefox)	ELSA-2026-7671	2026-04-13
Oracle Linux version 9 (thunderbird)	ELSA-2026-8459	2026-04-16