Loading vulnerability…
Out-of-bounds read/write in libpng ARM NEON palette expansion
CVE-2026-33636 is an out-of-bounds read and write vulnerability in the ARM/AArch64 NEON-optimized palette expansion path of libpng versions 1.6.36 through 1.6.55. During expansion of 8-bit paletted image rows into RGB or RGBA data, the NEON loop processes a final partial chunk without checking whether sufficient input pixels remain. Because expansion proceeds backward from the end of the row, the final iteration can read and write before the beginning of the row buffer. Normal decoding of attacker-controlled PNG images can trigger the vulnerability when NEON optimization is enabled. Libpng 1.6.56 fixes the issue.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can corrupt memory and cause application crashes or denial of service, with possible information disclosure and integrity compromise. Arbitrary code execution is a potential consequence in affected applications, but is not established for every deployment. The CVSS v3.0 base score is 7.6, reflecting low confidentiality and integrity impacts and high availability impact.
If you can’t patch tonight, do this now.
Where supported, disable ARM/AArch64 NEON palette-expansion optimization or use a build without that optimization to avoid the vulnerable code path. Until patched, prevent affected applications from decoding untrusted PNG images. These measures do not replace installing the fix.
Patch, then assume compromise.
Upgrade libpng to version 1.6.56 or later, or install a vendor-provided package containing the backported fix. Echo packages are fixed in version 1.6.56-1 or later. For affected ExtremeCloud IQ - Site Engine deployments, upgrade to version 26.6.11 or later. Ensure applications bundling libpng receive the corrected library as well.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
42 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.