Loading vulnerability…
Zero-click remote code execution in Android System libpng
CVE-2026-58936 is a critical use-after-free vulnerability in libpng's png_set_tRNS function affecting the Android System component. The flaw can cause memory corruption and potentially allow remote code execution without additional execution privileges or user interaction. Affected Android releases include 14, 15, 16, 16 QPR2, and 17.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could allow a remote attacker to execute arbitrary code on an affected device without user interaction. The resulting execution context and access to protected resources are not specified; root access or a sandbox escape is not established.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary mitigation or workaround is documented. Platform protections may constrain exploitation but are not a substitute for installing the security update.
Patch, then assume compromise.
Install the manufacturer-provided November 2026 Android security update. Security patch level 2026-11-01 addresses the listed Android platform vulnerabilities; 2026-11-05 or later includes all applicable fixes from both November patch groups. Apply the corresponding Samsung security update where applicable and verify the installed security patch level. Exact fixed firmware builds and standalone libpng release versions are not specified.
No public exploits tracked yet. Mallory keeps watching.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.