Loading story…
Microsoft and security researchers disclosed two high-severity libpng vulnerabilities that can be triggered by processing crafted PNG files, exposing applications and services that rely on the library for image handling. CVE-2026-33416 is a use-after-free bug tied to pointer aliasing in png_set_tRNS and png_set_PLTE, affecting libpng through version 1.6.55; the flaw can cause heap corruption and may enable arbitrary code execution, particularly where protections such as ASLR or PIE are absent. Microsoft published guidance for CVE-2026-33416 through its Security Update Guide.
A second issue, CVE-2026-33636, affects ARM and AArch64 platforms in Neon-optimized palette expansion code introduced in version 1.6.36, creating an out-of-bounds read/write condition that can leak sensitive data, corrupt memory, and reliably crash processes. The vulnerabilities affect web applications, embedded devices, and server-side image processing pipelines that parse untrusted PNG content. Maintainers released patched versions 1.6.56 and 1.8.0; as a temporary mitigation for the ARM-specific flaw, organizations can rebuild libpng with hardware optimizations disabled.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Two high-severity libpng flaws, CVE-2026-33416 and CVE-2026-33636, were publicly disclosed as affecting crafted PNG parsing. Maintainers released libpng versions 1.6.56 and 1.8.0 to fix the issues, and a temporary workaround was noted for the ARM-specific flaw by disabling hardware optimizations during recompilation.
Microsoft's Security Update Guide listed CVE-2026-33416, a libpng use-after-free vulnerability caused by pointer aliasing in png_set_tRNS and png_set_PLTE.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Germany's dCERT published two advisories affecting **libpng**, warning of multiple security flaws in the widely used PNG image-processing library. Advisory `2026-0850` reported **multiple vulnerabilities** in libpng, indicating that several weaknesses were identified in the component used across operating systems, applications, and web services to parse and render PNG files. A follow-up advisory, `2026-1004`, highlighted a **libpng vulnerability that allows information disclosure**, showing that at least one of the reported issues could expose sensitive data during image handling. The advisories underscore the risk posed by vulnerable image-parsing libraries embedded in many products, and organizations using libpng directly or through dependent software may need to review vendor guidance and apply available updates.
Jun 29, 2026
Microsoft published multiple security advisories for **Windows**, **Azure**, and **developer tooling**, including several high-impact issues spanning **remote code execution (RCE)**, **elevation of privilege (EoP)**, **spoofing**, **information disclosure**, **denial of service**, and **security feature bypass**. Notable items include **Azure SDK for Python RCE** `CVE-2026-21531` (CVSS 9.8; **deserialization of untrusted data**), **Windows Shell security feature bypass** `CVE-2026-21510` (CVSS 8.8; exploitability listed as **E:F**), **GitHub Copilot/Visual Studio/VS Code** issues enabling **RCE/EoP/feature bypass** (`CVE-2026-21256`, `CVE-2026-21523`, `CVE-2026-21257`, `CVE-2026-21518`), and **Azure Local RCE** `CVE-2026-21228` (CVSS 8.1; **improper certificate validation**). Additional Windows platform flaws include **Desktop Window Manager EoP** `CVE-2026-21519` (type confusion), **HTTP.sys EoP** `CVE-2026-21232` (untrusted pointer dereference), **WinSock Ancillary Function Driver EoP** `CVE-2026-21238` (improper access control), **Windows Storage EoP** `CVE-2026-21508`, **WSL EoP** `CVE-2026-21237`, **Microsoft Word security feature bypass** `CVE-2026-21514`, **Outlook spoofing** `CVE-2026-21511`, **Windows LDAP DoS** `CVE-2026-21243`, plus **ACI Confidential Containers information disclosure** `CVE-2026-23655` and **Azure IoT Explorer information disclosure** `CVE-2026-21528`. Separately, a detailed third-party writeup described a **Windows Error Reporting Service** local privilege escalation, `CVE-2026-20817`, patched in January 2026, where the **WER service** (`wersvc.dll`) running as `NT AUTHORITY\SYSTEM` allegedly fails to validate requester permissions over **ALPC**, enabling a standard user to trigger process creation with a SYSTEM-derived token (retaining powerful rights such as *SeDebugPrivilege*, *SeImpersonatePrivilege*, and *SeBackupPrivilege*). Another third-party report highlighted a long-standing **libpng** heap buffer issue, `CVE-2026-25646` (CVSS 8.3), in `png_set_quantize()` that can be triggered by a crafted PNG (palette present, histogram absent) leading to an infinite loop/out-of-bounds read with potential for DoS and, with heap grooming, possible code execution; an additional MSRC entry referenced **libjpeg-turbo** `CVE-2023-2804` (heap-based overflow) as an Important RCE-class issue. Collectively, the disclosures reinforce the need to prioritize patching for internet-reachable components and developer tooling, and to treat local EoP bugs as high-risk in post-compromise and lateral movement scenarios.
Jun 29, 2026
LibRaw 0.22.1 was released with security fixes for multiple high-severity memory corruption and integer overflow vulnerabilities in the library’s RAW image parsing code, including **CVE-2026-21413** in `lossless_jpeg_load_raw`, **CVE-2026-20889** in `x3f_thumb_loader`, and **CVE-2026-20884** in `deflate_dng_load_raw`. The flaws were reported by Cisco Talos and affect parsing paths for formats such as Canon `CR2`, Sigma `X3F`, and DNG files, where crafted metadata or compressed image data can trigger heap-based buffer overflows or undersized allocations followed by out-of-bounds writes.
Jun 29, 2026