CVE-2026-34757
published 2026-04-09CVE-2026-34757: LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to…
PriorityP420medium4.4CVSS 3.1
AVLACLPRLUINSUCLILAN
EPSS
0.19%
9.5th percentile
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct). This vulnerability is fixed in 1.6.57.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | libpng1.6 | — | — |
| libpng | libpng | >= 1.0.9 < 1.6.57 | 1.6.57 |
| pnggroup | libpng | — | — |
| ubuntu | libpng1.6 | — | — |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
vendor_ubuntu7.5HIGH
vendor_debian5.1MEDIUM
vendor_redhat5.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libpng vulnerabilities
vendor_ubuntu·2026-05-07·CVSS 7.5
CVE-2026-33416 [HIGH] libpng vulnerabilities
Title: libpng vulnerabilities
Summary: Several security issues were fixed in libpng.
It was discovered that libpng incorrectly handled memory when processing
certain PNG files. If a user or automated system were tricked into opening
a specially crafted PNG file, an attacker could use this issue to cause
libpng to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2026-33416)
It was discovered that libpng incorrectly handled expanding 8-bit paletted
rows to RGB or RGBA on ARM processors. If a user or automated system were
tricked into opening a specially crafted PNG file, an attacker could use
this issue to cause libpng to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2026-33636)
It was discovered that libpng incorrectly
Red Hat
libpng: libpng: Information disclosure and data corruption via use-after-free vulnerability
vendor_redhat·2026-04-09·CVSS 5.1
CVE-2026-34757 [MEDIUM] CWE-825 libpng: libpng: Information disclosure and data corruption via use-after-free vulnerability
libpng: libpng: Information disclosure and data corruption via use-after-free vulnerability
A flaw was found in libpng, a library used for handling PNG (Portable Network Graphics) image files. This vulnerability arises when an application reuses a pointer, previously obtained from functions like png_get_PLTE, by passing it back to a corresponding setter function within the same image structure. This action causes the setter to access memory that has already been deallocated, leading to a use-after-free condition. A local attacker could potentially exploit this flaw to corrupt image metadata or disclose sensitive information from the application's memory.
Statement: This is a Moderate impact use-after-free vulnerability in libpng. The flaw occurs when an application reuses a pointer from
Debian
CVE-2026-34757: libpng1.6
vendor_debian·2026·CVSS 5.1
CVE-2026-34757 [MEDIUM] CVE-2026-34757: libpng1.6
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
VulDB
libpng up to 1.6.56 Chunk Setter API png_set_hIST use after free (Nessus ID 305709 / WID-SEC-2026-1023)
vuldb·2026-04-22·CVSS 5.1
CVE-2026-34757 [MEDIUM] libpng up to 1.6.56 Chunk Setter API png_set_hIST use after free (Nessus ID 305709 / WID-SEC-2026-1023)
A vulnerability labeled as critical has been found in libpng up to 1.6.56. The impacted element is the function png_set_hIST of the component Chunk Setter API. Executing a manipulation can lead to use after free.
This vulnerability is handled as CVE-2026-34757. The attack can be executed remotely. There is not any exploit available.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-35604 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-35604 [MEDIUM] CVE-2026-35604 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-35604 :
Wolfi vulnerability analysis and mitigation
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, when an admin revokes a user's Share and Download permissions, existing share links created by that user remain fully accessible to unauthenticated users. The public share download handler does not re-check the share owner's current permissions. This vulnerability is fixed in 2.63.1.
Source : NVD
## 8.2
Score
Published April 7, 2026
Severity HIGH
CNA Score 8.2
Affected Technologies
Wolfi
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 17.4
Exploitation Probab
Wiz
CVE-2026-35606 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-35606 [MEDIUM] CVE-2026-35606 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-35606 :
Wolfi vulnerability analysis and mitigation
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the resourceGetHandler in http/resource.go returns full text file content without checking the Perm.Download permission flag. All three other content-serving endpoints (/api/raw, /api/preview, /api/subtitle) correctly verify this permission before serving content. A user with download: false can read any text file within their scope through two bypass paths. This vulnerability is fixed in 2.63.1.
Source : NVD
## 5.3
Score
Published April 7, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
Wolfi
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
C
Wiz
CVE-2026-35607 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-35607 [MEDIUM] CVE-2026-35607 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-35607 :
Wolfi vulnerability analysis and mitigation
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the fix in commit b6a4fb1 ("self-registered users don't get execute perms") stripped Execute permission and Commands from users created via the signup handler. The same fix was not applied to the proxy auth handler. Users auto-created on first successful proxy-auth login are granted execution capabilities from global defaults, even though the signup path was explicitly changed to prevent execution rights from being inherited by automatically provisioned accounts. This vulnerability is fixed in 2.63.1.
Source : NVD
## 8.1
Score
Published April 7, 2026
Severity HIGH
C
Wiz
CVE-2026-34757 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.2
CVE-2026-34757 [HIGH] CVE-2026-34757 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34757 :
OpenJDK JDK vulnerability analysis and mitigation
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct). This vulnerability is fixed
Wiz
CVE-2026-35605 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-35605 [MEDIUM] CVE-2026-35605 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-35605 :
Wolfi vulnerability analysis and mitigation
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the Matches() function in rules/rules.go uses strings.HasPrefix() without a trailing directory separator when matching paths against access rules. A rule for /uploads also matches /uploads_backup/, granting or denying access to unintended directories. This vulnerability is fixed in 2.63.1.
Source : NVD
## 6.3
Score
Published April 7, 2026
Severity MEDIUM
CNA Score 6.3
Affected Technologies
Wolfi
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 19.6
Exploitatio
Wiz
CVE-2026-34371 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.3
CVE-2026-34371 [MEDIUM] CVE-2026-34371 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34371 :
Chainguard vulnerability analysis and mitigation
LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the execute_code sandbox when persisting code-generated artifacts. On deployments using the default local file strategy, a malicious artifact filename containing traversal sequences (for example, ../../../../../app/client/dist/poc.txt) is concatenated into the server-side destination path and written with fs.writeFileSync() without sanitization. This gives any user who can trigger execute_code an arbitrary file write primitive as the LibreChat server user. This vulnerability is fixed in 0.8.4.
Source : NVD
## 6.3
Score
Published April 7, 2026
Severity MEDIUM
CNA Score 6.3
Affected Technologies
Cha
Wiz
CVE-2026-34972 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-34972 [MEDIUM] CVE-2026-34972 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34972 :
Wolfi vulnerability analysis and mitigation
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper policy enforcement. This vulnerability is fixed in 1.14.0.
Source : NVD
## 5
Score
Published April 6, 2026
Severity MEDIUM
CNA Score 5.0
Affected Technologies
Wolfi
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 9.9
Exploitation Probability (EPSS) N/A
Affected packages and libraries
grafana-12.3
grafana-12.4
Source
Wiz
CVE-2026-39957 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-39957 [MEDIUM] CVE-2026-39957 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-39957 :
Wolfi vulnerability analysis and mitigation
Lychee is a free, open-source photo-management tool. Prior to 7.5.4, a SQL operator-precedence bug in SharingController::listAll() causes the orWhereNotNull('user_group_id') clause to escape the ownership filter applied by the when() block. Any authenticated non-admin user with upload permission who owns at least one album can retrieve all user-group-based sharing permissions across the entire instance, including private albums owned by other users. This vulnerability is fixed in 7.5.4.
Source : NVD
## 2.3
Score
Published April 9, 2026
Severity LOW
CNA Score 2.3
Affected Technologies
Wolfi
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Pro
Wiz
CVE-2026-35585 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-35585 [MEDIUM] CVE-2026-35585 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-35585 :
Wolfi vulnerability analysis and mitigation
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 through 2.63.1, the hook system in File Browser — which executes administrator-defined shell commands on file events such as upload, rename, and delete — is vulnerable to OS command injection. Variable substitution for values like $FILE and $USERNAME is performed via os.Expand without sanitization. An attacker with file write permission can craft a malicious filename containing shell metacharacters, causing the server to execute arbitrary OS commands when the hook fires. This results in Remote Code Execution (RCE). This feature has been disabled by default for all installations f
Bugzilla
CVE-2026-34757 libpng: libpng: Information disclosure and data corruption via use-after-free vulnerability
bugzilla·2026-04-09·CVSS 5.1
CVE-2026-34757 [MEDIUM] CVE-2026-34757 libpng: libpng: Information disclosure and data corruption via use-after-free vulnerability
CVE-2026-34757 libpng: libpng: Information disclosure and data corruption via use-after-free vulnerability
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk
https://github.com/pnggroup/libpng/commit/398cbe3df03f4e11bb031e07f416dfdde3684e8ahttps://github.com/pnggroup/libpng/commit/55d20aaa322c9274491cda82c5cd4f99b48c6bcchttps://github.com/pnggroup/libpng/issues/836https://github.com/pnggroup/libpng/issues/837https://github.com/pnggroup/libpng/security/advisories/GHSA-6fr7-g8h7-v645https://lists.debian.org/debian-lts-announce/2026/05/msg00017.html
2026-04-09
Published