Loading story…
Germany's dCERT published two advisories affecting libpng, warning of multiple security flaws in the widely used PNG image-processing library. Advisory 2026-0850 reported multiple vulnerabilities in libpng, indicating that several weaknesses were identified in the component used across operating systems, applications, and web services to parse and render PNG files.
A follow-up advisory, 2026-1004, highlighted a libpng vulnerability that allows information disclosure, showing that at least one of the reported issues could expose sensitive data during image handling. The advisories underscore the risk posed by vulnerable image-parsing libraries embedded in many products, and organizations using libpng directly or through dependent software may need to review vendor guidance and apply available updates.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
dCERT issued Advisory 2026-1004 for a libpng vulnerability that allows information disclosure. This represents a separate disclosed issue affecting libpng.
dCERT issued Advisory 2026-0850 covering multiple vulnerabilities in libpng. The advisory marks the public disclosure of these security issues by dCERT.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft and security researchers disclosed **two high-severity libpng vulnerabilities** that can be triggered by processing crafted PNG files, exposing applications and services that rely on the library for image handling. **`CVE-2026-33416`** is a use-after-free bug tied to pointer aliasing in `png_set_tRNS` and `png_set_PLTE`, affecting libpng through version `1.6.55`; the flaw can cause heap corruption and may enable arbitrary code execution, particularly where protections such as ASLR or PIE are absent. Microsoft published guidance for `CVE-2026-33416` through its Security Update Guide. A second issue, **`CVE-2026-33636`**, affects **ARM and AArch64** platforms in Neon-optimized palette expansion code introduced in version `1.6.36`, creating an out-of-bounds read/write condition that can leak sensitive data, corrupt memory, and reliably crash processes. The vulnerabilities affect web applications, embedded devices, and server-side image processing pipelines that parse untrusted PNG content. Maintainers released patched versions **`1.6.56`** and **`1.8.0`**; as a temporary mitigation for the ARM-specific flaw, organizations can rebuild libpng with hardware optimizations disabled.
Jun 29, 2026
dCERT issued two advisories on **multiple vulnerabilities in ImageMagick**, the widely used image processing suite, indicating ongoing security issues affecting the software. The advisories, `2026-0474` and `2026-0633`, both identify ImageMagick as the impacted product but do not provide public synopses, suggesting organizations should review the vendor and downstream security guidance directly for affected versions and technical details. Because ImageMagick is commonly embedded in web applications, content management systems, and backend media-processing pipelines, unpatched flaws can create risk across a broad range of environments. Security teams should inventory systems and applications that rely on ImageMagick, monitor for updated package releases and distribution-specific patches, and prioritize remediation to reduce exposure from potential image parsing and processing attacks.
Jun 29, 2026
German government advisories warned of security flaws in two widely used image-processing applications, with **GIMP** affected by a vulnerability that could allow **code execution** and **ImageMagick** affected by a separate flaw that could enable an **unspecified attack**. The notices identify both products as requiring security review because they are commonly used to open, convert, and manipulate untrusted image files in desktop and server-side workflows. The GIMP issue presents the more severe risk because successful exploitation could let an attacker run code on a target system, while the ImageMagick issue may expose systems that rely on automated image handling to further compromise depending on deployment context. Organizations using either tool in user workstations, content pipelines, or backend processing environments should verify affected versions, apply vendor fixes or distribution updates, and restrict processing of untrusted files until remediation is complete.
Jun 29, 2026