Read the docs
TI-2026-25813 Aliases CVE-2026-33416

LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`

Priority LOW 37CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 51 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE` each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng 1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS` sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr` pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01071 65th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial libpng (pnggroup): 1.6.56Red Hat: 65 advisoriesRed Hat: 51 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pnggrouplibpng1.2.1 to before 1.6.561.6.56Patch availableCNA
  • libpng Vendorpnggroup Affected 1.2.1 to before 1.6.56 Fixed in 1.6.56 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*1.2.1 to before 1.6.56Vulnerablepnggroup
  • cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:* Versions 1.2.1 to before 1.6.56 Vulnerable ·pnggroup

Remediation

  • Fix · CNA libpng (pnggroup) Fixed in 1.6.56

Red Hat 65 advisories

  • RHSA-2026:80330 Released 2026-10-11 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libpng-1.6.58-2.1.hum1@aarch64, libpng-1.6.58-2.1.hum1@s390x, libpng-1.6.58-2.1.hum1@src +10
  • RHSA-2026:74674 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:50808 Released 2026-08-05 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) libpng-2:1.5.13-8.el7_9.3, libpng-2:1.5.13-8.el7_9.3.ppc, libpng-devel-2:1.5.13-8.el7_9.3 +1
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) libpng-static-2:1.5.13-8.el7_9.3, libpng-static-2:1.5.13-8.el7_9.3.ppc
Show 62 more Red Hat advisories
  • RHSA-2026:43702 Released 2026-07-22 · Red Hat rating Moderate
    libpng12 security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) libpng12-1.2.50-10.el7_9.2, libpng12-1.2.50-10.el7_9.2.ppc
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) libpng12-devel-1.2.50-10.el7_9.2, libpng12-devel-1.2.50-10.el7_9.2.ppc
  • RHSA-2026:33313 Released 2026-06-29 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:28456 Released 2026-06-25 · Red Hat rating Moderate
    libpng15 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) libpng15-1.5.30-14.el9_6.2
  • RHSA-2026:29898 Released 2026-06-25 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux BaseOS (v. 8) libpng-2:1.6.34-11.el8_10, libpng-devel-2:1.6.34-11.el8_10
  • RHSA-2026:29901 Released 2026-06-25 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) libpng-2:1.6.34-8.el8_6.3, libpng-devel-2:1.6.34-8.el8_6.3
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) libpng-2:1.6.34-8.el8_6.3, libpng-devel-2:1.6.34-8.el8_6.3
  • RHSA-2026:29900 Released 2026-06-25 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) libpng-2:1.6.34-8.el8_8.3, libpng-devel-2:1.6.34-8.el8_8.3
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) libpng-2:1.6.34-8.el8_8.3, libpng-devel-2:1.6.34-8.el8_8.3
  • RHSA-2026:29902 Released 2026-06-25 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) libpng-2:1.6.34-8.el8_4.3, libpng-devel-2:1.6.34-8.el8_4.3
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) libpng-2:1.6.34-8.el8_4.3, libpng-devel-2:1.6.34-8.el8_4.3
  • RHSA-2026:29018 Released 2026-06-24 · Red Hat rating Moderate
    libpng12 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) libpng12-1.2.57-5.el8_8.2
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) libpng12-1.2.57-5.el8_8.2
  • RHSA-2026:29016 Released 2026-06-24 · Red Hat rating Moderate
    libpng15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) libpng15-1.5.30-7.el8_8.2
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) libpng15-1.5.30-7.el8_8.2
  • RHSA-2026:29020 Released 2026-06-24 · Red Hat rating Moderate
    libpng12 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) libpng12-1.2.57-5.el8_6.2
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) libpng12-1.2.57-5.el8_6.2
  • RHSA-2026:29019 Released 2026-06-24 · Red Hat rating Moderate
    libpng15 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) libpng15-1.5.30-7.el8_6.2
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) libpng15-1.5.30-7.el8_6.2
  • RHSA-2026:29021 Released 2026-06-24 · Red Hat rating Moderate
    libpng15 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) libpng15-1.5.30-7.el8_4.2
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libpng15-1.5.30-7.el8_4.2
  • RHSA-2026:29022 Released 2026-06-24 · Red Hat rating Moderate
    libpng12 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) libpng12-1.2.57-5.el8_4.2
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libpng12-1.2.57-5.el8_4.2
  • RHSA-2026:28255 Released 2026-06-23 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux AppStream (v. 9) libpng-2:1.6.37-15.el9_8.2, libpng-devel-2:1.6.37-15.el9_8.2
    • Red Hat Enterprise Linux BaseOS (v. 9) libpng-2:1.6.37-15.el9_8.2
  • RHSA-2026:28457 Released 2026-06-23 · Red Hat rating Moderate
    libpng15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) libpng15-1.5.30-14.el9_4.2
  • RHSA-2026:28244 Released 2026-06-23 · Red Hat rating Moderate
    libpng15 security update
    • Red Hat Enterprise Linux AppStream (v. 9) libpng15-1.5.30-15.el9_8.1
  • RHSA-2026:28458 Released 2026-06-23 · Red Hat rating Moderate
    libpng15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) libpng15-1.5.30-14.el9_2.2
  • RHSA-2026:28233 Released 2026-06-23 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux AppStream (v. 10) libpng-2:1.6.40-11.el10_2.1, libpng-devel-2:1.6.40-11.el10_2.1
    • Red Hat Enterprise Linux BaseOS (v. 10) libpng-2:1.6.40-11.el10_2.1
  • RHSA-2026:26347 Released 2026-06-16 · Red Hat rating Moderate
    libpng15 security update
    • Red Hat Enterprise Linux AppStream (v. 8) libpng15-1.5.30-9.el8_10
  • RHSA-2026:26348 Released 2026-06-16 · Red Hat rating Moderate
    libpng12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) libpng12-1.2.57-7.el8_10
  • RHSA-2026:25096 Released 2026-06-10 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (cuda)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:20548 Released 2026-05-26 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) libpng-2:1.6.37-12.el9_6.4, libpng-devel-2:1.6.37-12.el9_6.4
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) libpng-2:1.6.37-12.el9_6.4
  • RHSA-2026:20549 Released 2026-05-26 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) libpng-2:1.6.37-12.el9_4.4, libpng-devel-2:1.6.37-12.el9_4.4
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) libpng-2:1.6.37-12.el9_4.4
  • RHSA-2026:20551 Released 2026-05-26 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) libpng-2:1.6.40-8.el10_0.4, libpng-devel-2:1.6.40-8.el10_0.4
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) libpng-2:1.6.40-8.el10_0.4
  • RHSA-2026:20550 Released 2026-05-26 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) libpng-2:1.6.37-12.el9_2.4, libpng-devel-2:1.6.37-12.el9_2.4
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) libpng-2:1.6.37-12.el9_2.4
  • RHSA-2026:18064 Released 2026-05-18 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux AppStream (v. 10) libpng-2:1.6.40-8.el10_1.4, libpng-devel-2:1.6.40-8.el10_1.4
    • Red Hat Enterprise Linux BaseOS (v. 10) libpng-2:1.6.40-8.el10_1.4
  • RHSA-2026:18028 Released 2026-05-18 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux AppStream (v. 9) libpng-2:1.6.37-12.el9_7.4, libpng-devel-2:1.6.37-12.el9_7.4
    • Red Hat Enterprise Linux BaseOS (v. 9) libpng-2:1.6.37-12.el9_7.4
  • RHSA-2026:15889 Released 2026-05-11 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) thunderbird-140.9.1-1.el8_6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) thunderbird-140.9.1-1.el8_6
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) thunderbird-140.9.1-1.el8_6
  • RHSA-2026:14303 Released 2026-05-06 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) thunderbird-140.9.1-1.el8_4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) thunderbird-140.9.1-1.el8_4
  • RHSA-2026:14223 Released 2026-05-06 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) thunderbird-140.9.1-1.el8_8
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) thunderbird-140.9.1-1.el8_8
  • RHSA-2026:13977 Released 2026-05-06 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) firefox-140.9.1-2.el7_9
  • RHSA-2026:13922 Released 2026-05-06 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) firefox-140.9.1-1.el9_2, firefox-x11-140.9.1-1.el9_2
  • RHSA-2026:13683 Released 2026-05-05 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) firefox-140.9.1-1.el8_6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) firefox-140.9.1-1.el8_6
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) firefox-140.9.1-1.el8_6
  • RHSA-2026:13682 Released 2026-05-05 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) firefox-140.9.1-1.el8_8
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) firefox-140.9.1-1.el8_8
  • RHSA-2026:13665 Released 2026-05-05 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) firefox-140.9.1-1.el10_0
  • RHSA-2026:13600 Released 2026-05-05 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox-140.9.1-1.el8_4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) firefox-140.9.1-1.el8_4
  • RHSA-2026:13583 Released 2026-05-05 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) firefox-140.9.1-1.el9_6, firefox-x11-140.9.1-1.el9_6
  • RHSA-2026:13582 Released 2026-05-05 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) firefox-140.9.1-1.el9_4, firefox-x11-140.9.1-1.el9_4
  • RHSA-2026:13596 Released 2026-05-05 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) firefox-140.9.1-1.el9_0
  • RHSA-2026:13533 Released 2026-05-04 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) thunderbird-140.9.1-1.el9_4
  • RHSA-2026:13412 Released 2026-05-04 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) thunderbird-140.9.1-1.el9_2
  • RHSA-2026:13342 Released 2026-05-04 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) thunderbird-140.9.1-1.el9_6
  • RHSA-2026:12264 Released 2026-04-30 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) thunderbird-140.9.1-1.el9_0
  • RHSA-2026:11813 Released 2026-04-29 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) thunderbird-140.9.1-1.el10_0
  • RHSA-2026:11805 Released 2026-04-29 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) firefox-140.9.1-1.el8_2
  • RHSA-2026:9689 Released 2026-04-24 · Red Hat rating Important
    java-21-openjdk security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el9 +11
    • Red Hat CodeReady Linux Builder EUS (v.9.6) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el9 +11
    • Red Hat Enterprise Linux AppStream (v. 10) java-21-openjdk-1:21.0.11.0.10-2.el10_2, java-21-openjdk-demo-1:21.0.11.0.10-2.el10_2, java-21-openjdk-devel-1:21.0.11.0.10-2.el10_2 +6
    • Red Hat Enterprise Linux AppStream (v. 8) java-21-openjdk-1:21.0.11.0.10-1.el8, java-21-openjdk-demo-1:21.0.11.0.10-1.el8, java-21-openjdk-devel-1:21.0.11.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream (v. 9) java-21-openjdk-1:21.0.11.0.10-2.el9, java-21-openjdk-demo-1:21.0.11.0.10-2.el9, java-21-openjdk-devel-1:21.0.11.0.10-2.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) java-21-openjdk-1:21.0.11.0.10-1.el10_2, java-21-openjdk-demo-1:21.0.11.0.10-1.el10_2, java-21-openjdk-devel-1:21.0.11.0.10-1.el10_2 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) java-21-openjdk-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-1:21.0.11.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) java-21-openjdk-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-1:21.0.11.0.10-1.el9 +6
    • Red Hat Enterprise Linux CRB (v. 8) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el8, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el8, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el8 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-2.el10_2, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-2.el10_2, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-2.el10_2 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-2.el9, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-2.el9, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-2.el9 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el10_2, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el10_2, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el10_2 +11
  • RHSA-2026:9683 Released 2026-04-24 · Red Hat rating Important
    java-1.8.0-openjdk security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.492.b09-1.el9 +7
    • Red Hat CodeReady Linux Builder EUS (v.9.6) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.492.b09-1.el9 +7
    • Red Hat Enterprise Linux AppStream (v. 8) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream (v. 9) java-1.8.0-openjdk-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-2.el9 +4
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux CRB (v. 8) java-1.8.0-openjdk-accessibility-fastdebug-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-slowdebug-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-1.el8 +9
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.492.b09-2.el9 +7
  • RHSA-2026:9686 Released 2026-04-24 · Red Hat rating Important
    java-17-openjdk security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-1.el9 +11
    • Red Hat CodeReady Linux Builder EUS (v.9.6) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-1.el9 +11
    • Red Hat Enterprise Linux AppStream (v. 8) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream (v. 9) java-17-openjdk-1:17.0.19.0.10-2.el9, java-17-openjdk-demo-1:17.0.19.0.10-2.el9, java-17-openjdk-devel-1:17.0.19.0.10-2.el9 +6
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el8 +20
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux CRB (v. 8) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-1.el8 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-2.el9, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-2.el9, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-2.el9 +11
  • RHSA-2026:9690 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 21.0.11 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 21.0.11
  • RHSA-2026:9694 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 25.0.3 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 25.0.3
  • RHSA-2026:9684 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 8u492 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 8u492
  • RHSA-2026:9687 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 17.0.19 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 17.0.9
  • RHSA-2026:9693 Released 2026-04-22 · Red Hat rating Important
    java-25-openjdk security update
    • Red Hat Enterprise Linux AppStream (v. 10) java-25-openjdk-1:25.0.3.0.9-1.el10_2, java-25-openjdk-crypto-adapter-1:25.0.3.0.9-1.el10_2, java-25-openjdk-demo-1:25.0.3.0.9-1.el10_2 +7
    • Red Hat Enterprise Linux AppStream (v. 9) java-25-openjdk-1:25.0.3.0.9-1.el9, java-25-openjdk-crypto-adapter-1:25.0.3.0.9-1.el9, java-25-openjdk-demo-1:25.0.3.0.9-1.el9 +7
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) java-25-openjdk-crypto-adapter-fastdebug-1:25.0.3.0.9-1.el10_2, java-25-openjdk-crypto-adapter-slowdebug-1:25.0.3.0.9-1.el10_2, java-25-openjdk-demo-fastdebug-1:25.0.3.0.9-1.el10_2 +13
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-25-openjdk-crypto-adapter-fastdebug-1:25.0.3.0.9-1.el9, java-25-openjdk-crypto-adapter-slowdebug-1:25.0.3.0.9-1.el9, java-25-openjdk-demo-fastdebug-1:25.0.3.0.9-1.el9 +13
  • RHSA-2026:9255 Released 2026-04-22 · Red Hat rating Important
    OpenJDK 11.0.31 ELS Security Update for Portable Linux Builds
    • OPENJDK ELS 11.0.31
  • RHSA-2026:9254 Released 2026-04-22 · Red Hat rating Important
    Java 11 OpenJDK ELS Security Update
    • Red Hat OpenJDK 11 ELS for RHEL 7 java-11-openjdk-1:11.0.31.0.11-1.el7_9, java-11-openjdk-debug-1:11.0.31.0.11-1.el7_9, java-11-openjdk-demo-1:11.0.31.0.11-1.el7_9 +15
    • Red Hat OpenJDK 11 ELS for RHEL 8 java-11-openjdk-1:11.0.31.0.11-1.el8, java-11-openjdk-demo-1:11.0.31.0.11-1.el8, java-11-openjdk-demo-fastdebug-1:11.0.31.0.11-1.el8 +20
    • Red Hat OpenJDK 11 ELS for RHEL 9 java-11-openjdk-1:11.0.31.0.11-1.el9, java-11-openjdk-demo-1:11.0.31.0.11-1.el9, java-11-openjdk-demo-fastdebug-1:11.0.31.0.11-1.el9 +20
  • RHSA-2026:9638 Released 2026-04-22 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 10) thunderbird-140.9.1-1.el10_1
  • RHSA-2026:9345 Released 2026-04-21 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 8) thunderbird-140.9.1-1.el8_10
  • RHSA-2026:8459 Released 2026-04-16 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 9) thunderbird-140.9.1-1.el9_7
  • RHSA-2026:8052 Released 2026-04-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream (v. 8) firefox-140.9.1-1.el8_10
  • RHSA-2026:7671 Released 2026-04-13 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream (v. 9) firefox-140.9.1-1.el9_7, firefox-x11-140.9.1-1.el9_7
  • RHSA-2026:7672 Released 2026-04-13 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream (v. 10) firefox-140.9.1-1.el10_1
  • RHSA-2026:6732 Released 2026-04-07 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libpng-1.6.56-1.hum1@aarch64, libpng-1.6.56-1.hum1@src, libpng-1.6.56-1.hum1@x86_64 +6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat build of OpenJDK 1.8AffectedNo fix yet
Red Hat build of OpenJDK 11 ELSAffectedNo fix yet
Red Hat build of OpenJDK 17AffectedNo fix yet
Red Hat build of OpenJDK 21AffectedNo fix yet
OPENJDK ELS 11.0.31Fixed RHSA-2026:9255
Red Hat AI Inference Server 3.2Fixed RHSA-2026:25096
Red Hat Build of OpenJDK 17.0.9Fixed RHSA-2026:9687
Red Hat Build of OpenJDK 21.0.11Fixed RHSA-2026:9690
Red Hat Build of OpenJDK 25.0.3Fixed RHSA-2026:9694
Red Hat Build of OpenJDK 8u492Fixed RHSA-2026:9684
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Discovery 2Fixed RHSA-2026:33313
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:18064, RHSA-2026:28233, RHSA-2026:7672, RHSA-2026:9638, RHSA-2026:9689, RHSA-2026:9693
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:26347, RHSA-2026:26348, RHSA-2026:8052, RHSA-2026:9345, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:18028, RHSA-2026:28244, RHSA-2026:28255, RHSA-2026:7671, RHSA-2026:8459, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689, RHSA-2026:9693
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2026:11805, RHSA-2026:9683
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:13600, RHSA-2026:14303, RHSA-2026:29021, RHSA-2026:29022, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:13683, RHSA-2026:15889, RHSA-2026:29019, RHSA-2026:29020, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:13683, RHSA-2026:15889, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:13682, RHSA-2026:14223, RHSA-2026:29016, RHSA-2026:29018, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:12264, RHSA-2026:13596, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:13412, RHSA-2026:13922, RHSA-2026:20550, RHSA-2026:28458, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:28457
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:11813, RHSA-2026:13665, RHSA-2026:20551, RHSA-2026:9689
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:13533, RHSA-2026:13582, RHSA-2026:20549, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:13342, RHSA-2026:13583, RHSA-2026:20548, RHSA-2026:28456, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:13600, RHSA-2026:14303, RHSA-2026:29021, RHSA-2026:29022, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:29019, RHSA-2026:29020
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:13683, RHSA-2026:15889, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:13682, RHSA-2026:14223, RHSA-2026:29016, RHSA-2026:29018, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:18064, RHSA-2026:28233
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:29898
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:18028, RHSA-2026:28255
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:29902
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:29901
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:29900
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:20550
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:20551
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2026:20549
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:20548
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:29902
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)Fixed RHSA-2026:29901
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:29900
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:9689, RHSA-2026:9693
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689, RHSA-2026:9693
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:9689
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:13977, RHSA-2026:43702, RHSA-2026:50808
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:43702, RHSA-2026:50808
Red Hat Hardened ImagesFixed RHSA-2026:6732, RHSA-2026:80330
Red Hat OpenJDK 11 ELS for RHEL 7Fixed RHSA-2026:9254
Red Hat OpenJDK 11 ELS for RHEL 8Fixed RHSA-2026:9254
Red Hat OpenJDK 11 ELS for RHEL 9Fixed RHSA-2026:9254
Red Hat OpenShift AI 3.4Fixed RHSA-2026:74674
Not affected: 5 products
  • Red Hat Discovery 2
  • Red Hat OpenShift Container Platform 4
  • Red Hat build of OpenJDK 11 ELS
  • Red Hat build of OpenJDK 17
  • Red Hat build of OpenJDK 21

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33416
  2. 2026-10-09 Fix available: RHSA-2026:9255 · Red Hat
  3. 2026-10-11 Fix available: OPENJDK ELS 11.0.31 · Red Hat
  4. 2026-10-12 Fix available: RHSA-2026:80330 · Red Hat
  5. 2026-10-12 Affected versions changed · Red Hat
  6. 2026-10-30 Fix available: RHSA-2026:9684 · Red Hat
  7. 2026-10-30 Fix available: RHSA-2026:9694 · Red Hat
  8. 2026-10-30 Fix available: RHSA-2026:9690 · Red Hat
  9. 2026-10-30 Fix available: Red Hat Build of OpenJDK 21.0.11, Red Hat Build of OpenJDK 25.0.3, Red Hat Build of OpenJDK 8u492 · Red Hat
  10. 2026-10-31 Fix available: RHSA-2026:9687 · Red Hat
  11. 2026-10-31 Fix available: Red Hat Build of OpenJDK 17.0.9 · Red Hat

References

Exploit 1

Patch 5

  • TI-2011-02683 Integer signedness error in the png_inflate function in pngrutil.c in libpng before… CVSS 3.1HIGH 8.8
  • TI-2010-01161 Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in… CVSS 3.1CRITICAL 9.8
  • TI-2026-20746 LIBPNG has a heap buffer overflow in png_set_quantize CVSS 4.0HIGH 8.3
  • TI-2025-40204 LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read` CVSS 3.1HIGH 7.1
  • TI-2025-40767 LIBPNG has an out-of-bounds read in png_image_read_composite CVSS 3.1HIGH 7.1
  • TI-2025-40066 LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication CVSS 3.1HIGH 7.1
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences