Read the docs
TI-2026-26017 Aliases CVE-2026-33636

LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64

Priority LOW 35CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · High
Fix status
Partial Red Hat: 42 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without verifying that enough input pixels remain. Because the implementation works backward from the end of the row, the final iteration dereferences pointers before the start of the row buffer (OOB read) and writes expanded pixel data to the same underflowed positions (OOB write). This is reachable via normal decoding of attacker-controlled PNG input if Neon is enabled. Version 1.6.56 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00751 55th percentileScored 2026-11-07
Fix Partial libpng (pnggroup): 1.6.56Red Hat: 48 advisoriesRed Hat: 42 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pnggrouplibpng1.6.36 to before 1.6.561.6.56Patch availableCNA
  • libpng Vendorpnggroup Affected 1.6.36 to before 1.6.56 Fixed in 1.6.56 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*1.6.36 to before 1.6.56Vulnerablepnggroup
  • cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:* Versions 1.6.36 to before 1.6.56 Vulnerable ·pnggroup

Remediation

  • Fix · CNA libpng (pnggroup) Fixed in 1.6.56

Red Hat 48 advisories

  • RHSA-2026:80330 Released 2026-10-11 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libpng-1.6.58-2.1.hum1@aarch64, libpng-1.6.58-2.1.hum1@s390x, libpng-1.6.58-2.1.hum1@src +10
  • RHSA-2026:74674 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:33313 Released 2026-06-29 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
Show 45 more Red Hat advisories
  • RHSA-2026:28255 Released 2026-06-23 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux AppStream (v. 9) libpng-2:1.6.37-15.el9_8.2, libpng-devel-2:1.6.37-15.el9_8.2
    • Red Hat Enterprise Linux BaseOS (v. 9) libpng-2:1.6.37-15.el9_8.2
  • RHSA-2026:28233 Released 2026-06-23 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux AppStream (v. 10) libpng-2:1.6.40-11.el10_2.1, libpng-devel-2:1.6.40-11.el10_2.1
    • Red Hat Enterprise Linux BaseOS (v. 10) libpng-2:1.6.40-11.el10_2.1
  • RHSA-2026:25096 Released 2026-06-10 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (cuda)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:17685 Released 2026-05-14 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) libpng-2:1.6.37-12.el9_0.3, libpng-devel-2:1.6.37-12.el9_0.3
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) libpng-2:1.6.37-12.el9_0.3
  • RHSA-2026:17642 Released 2026-05-14 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) libpng-2:1.6.37-12.el9_2.3, libpng-devel-2:1.6.37-12.el9_2.3
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) libpng-2:1.6.37-12.el9_2.3
  • RHSA-2026:17603 Released 2026-05-14 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) libpng-2:1.6.37-12.el9_4.3, libpng-devel-2:1.6.37-12.el9_4.3
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) libpng-2:1.6.37-12.el9_4.3
  • RHSA-2026:17567 Released 2026-05-14 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) libpng-2:1.6.40-8.el10_0.3, libpng-devel-2:1.6.40-8.el10_0.3
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) libpng-2:1.6.40-8.el10_0.3
  • RHSA-2026:17524 Released 2026-05-14 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) libpng-2:1.6.37-12.el9_6.3, libpng-devel-2:1.6.37-12.el9_6.3
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) libpng-2:1.6.37-12.el9_6.3
  • RHSA-2026:15889 Released 2026-05-11 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) thunderbird-140.9.1-1.el8_6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) thunderbird-140.9.1-1.el8_6
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) thunderbird-140.9.1-1.el8_6
  • RHSA-2026:14791 Released 2026-05-07 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux AppStream (v. 9) libpng-2:1.6.37-12.el9_7.3, libpng-devel-2:1.6.37-12.el9_7.3
    • Red Hat Enterprise Linux BaseOS (v. 9) libpng-2:1.6.37-12.el9_7.3
  • RHSA-2026:14790 Released 2026-05-07 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux AppStream (v. 10) libpng-2:1.6.40-8.el10_1.3, libpng-devel-2:1.6.40-8.el10_1.3
    • Red Hat Enterprise Linux BaseOS (v. 10) libpng-2:1.6.40-8.el10_1.3
  • RHSA-2026:14303 Released 2026-05-06 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) thunderbird-140.9.1-1.el8_4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) thunderbird-140.9.1-1.el8_4
  • RHSA-2026:14223 Released 2026-05-06 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) thunderbird-140.9.1-1.el8_8
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) thunderbird-140.9.1-1.el8_8
  • RHSA-2026:13977 Released 2026-05-06 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) firefox-140.9.1-2.el7_9
  • RHSA-2026:13922 Released 2026-05-06 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) firefox-140.9.1-1.el9_2, firefox-x11-140.9.1-1.el9_2
  • RHSA-2026:13683 Released 2026-05-05 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) firefox-140.9.1-1.el8_6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) firefox-140.9.1-1.el8_6
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) firefox-140.9.1-1.el8_6
  • RHSA-2026:13682 Released 2026-05-05 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) firefox-140.9.1-1.el8_8
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) firefox-140.9.1-1.el8_8
  • RHSA-2026:13665 Released 2026-05-05 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) firefox-140.9.1-1.el10_0
  • RHSA-2026:13600 Released 2026-05-05 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox-140.9.1-1.el8_4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) firefox-140.9.1-1.el8_4
  • RHSA-2026:13583 Released 2026-05-05 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) firefox-140.9.1-1.el9_6, firefox-x11-140.9.1-1.el9_6
  • RHSA-2026:13582 Released 2026-05-05 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) firefox-140.9.1-1.el9_4, firefox-x11-140.9.1-1.el9_4
  • RHSA-2026:13596 Released 2026-05-05 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) firefox-140.9.1-1.el9_0
  • RHSA-2026:13533 Released 2026-05-04 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) thunderbird-140.9.1-1.el9_4
  • RHSA-2026:13412 Released 2026-05-04 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) thunderbird-140.9.1-1.el9_2
  • RHSA-2026:13342 Released 2026-05-04 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) thunderbird-140.9.1-1.el9_6
  • RHSA-2026:12264 Released 2026-04-30 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) thunderbird-140.9.1-1.el9_0
  • RHSA-2026:11813 Released 2026-04-29 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) thunderbird-140.9.1-1.el10_0
  • RHSA-2026:11805 Released 2026-04-29 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) firefox-140.9.1-1.el8_2
  • RHSA-2026:9689 Released 2026-04-24 · Red Hat rating Important
    java-21-openjdk security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el9 +11
    • Red Hat CodeReady Linux Builder EUS (v.9.6) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el9 +11
    • Red Hat Enterprise Linux AppStream (v. 10) java-21-openjdk-1:21.0.11.0.10-2.el10_2, java-21-openjdk-demo-1:21.0.11.0.10-2.el10_2, java-21-openjdk-devel-1:21.0.11.0.10-2.el10_2 +6
    • Red Hat Enterprise Linux AppStream (v. 8) java-21-openjdk-1:21.0.11.0.10-1.el8, java-21-openjdk-demo-1:21.0.11.0.10-1.el8, java-21-openjdk-devel-1:21.0.11.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream (v. 9) java-21-openjdk-1:21.0.11.0.10-2.el9, java-21-openjdk-demo-1:21.0.11.0.10-2.el9, java-21-openjdk-devel-1:21.0.11.0.10-2.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) java-21-openjdk-1:21.0.11.0.10-1.el10_2, java-21-openjdk-demo-1:21.0.11.0.10-1.el10_2, java-21-openjdk-devel-1:21.0.11.0.10-1.el10_2 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) java-21-openjdk-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-1:21.0.11.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) java-21-openjdk-1:21.0.11.0.10-1.el9, java-21-openjdk-demo-1:21.0.11.0.10-1.el9, java-21-openjdk-devel-1:21.0.11.0.10-1.el9 +6
    • Red Hat Enterprise Linux CRB (v. 8) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el8, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el8, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el8 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-2.el10_2, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-2.el10_2, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-2.el10_2 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-2.el9, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-2.el9, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-2.el9 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) java-21-openjdk-demo-fastdebug-1:21.0.11.0.10-1.el10_2, java-21-openjdk-demo-slowdebug-1:21.0.11.0.10-1.el10_2, java-21-openjdk-devel-fastdebug-1:21.0.11.0.10-1.el10_2 +11
  • RHSA-2026:9683 Released 2026-04-24 · Red Hat rating Important
    java-1.8.0-openjdk security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.492.b09-1.el9 +7
    • Red Hat CodeReady Linux Builder EUS (v.9.6) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.492.b09-1.el9 +7
    • Red Hat Enterprise Linux AppStream (v. 8) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream (v. 9) java-1.8.0-openjdk-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-2.el9 +4
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el9, java-1.8.0-openjdk-devel-1:1.8.0.492.b09-1.el9 +4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) java-1.8.0-openjdk-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-1:1.8.0.492.b09-1.el8 +5
    • Red Hat Enterprise Linux CRB (v. 8) java-1.8.0-openjdk-accessibility-fastdebug-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-accessibility-slowdebug-1:1.8.0.492.b09-1.el8, java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-1.el8 +9
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-1.8.0-openjdk-demo-fastdebug-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-demo-slowdebug-1:1.8.0.492.b09-2.el9, java-1.8.0-openjdk-devel-fastdebug-1:1.8.0.492.b09-2.el9 +7
  • RHSA-2026:9686 Released 2026-04-24 · Red Hat rating Important
    java-17-openjdk security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-1.el9 +11
    • Red Hat CodeReady Linux Builder EUS (v.9.6) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-1.el9 +11
    • Red Hat Enterprise Linux AppStream (v. 8) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream (v. 9) java-17-openjdk-1:17.0.19.0.10-2.el9, java-17-openjdk-demo-1:17.0.19.0.10-2.el9, java-17-openjdk-devel-1:17.0.19.0.10-2.el9 +6
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) java-17-openjdk-1:17.0.19.0.10-1.el9, java-17-openjdk-demo-1:17.0.19.0.10-1.el9, java-17-openjdk-devel-1:17.0.19.0.10-1.el9 +6
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el8 +20
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) java-17-openjdk-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-1:17.0.19.0.10-1.el8 +6
    • Red Hat Enterprise Linux CRB (v. 8) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-1.el8, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-1.el8, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-1.el8 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-17-openjdk-demo-fastdebug-1:17.0.19.0.10-2.el9, java-17-openjdk-demo-slowdebug-1:17.0.19.0.10-2.el9, java-17-openjdk-devel-fastdebug-1:17.0.19.0.10-2.el9 +11
  • RHSA-2026:9690 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 21.0.11 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 21.0.11
  • RHSA-2026:9694 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 25.0.3 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 25.0.3
  • RHSA-2026:9684 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 8u492 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 8u492
  • RHSA-2026:9687 Released 2026-04-23 · Red Hat rating Important
    OpenJDK 17.0.19 Security Update for Portable Linux Builds
    • Red Hat Build of OpenJDK 17.0.9
  • RHSA-2026:9693 Released 2026-04-22 · Red Hat rating Important
    java-25-openjdk security update
    • Red Hat Enterprise Linux AppStream (v. 10) java-25-openjdk-1:25.0.3.0.9-1.el10_2, java-25-openjdk-crypto-adapter-1:25.0.3.0.9-1.el10_2, java-25-openjdk-demo-1:25.0.3.0.9-1.el10_2 +7
    • Red Hat Enterprise Linux AppStream (v. 9) java-25-openjdk-1:25.0.3.0.9-1.el9, java-25-openjdk-crypto-adapter-1:25.0.3.0.9-1.el9, java-25-openjdk-demo-1:25.0.3.0.9-1.el9 +7
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) java-25-openjdk-crypto-adapter-fastdebug-1:25.0.3.0.9-1.el10_2, java-25-openjdk-crypto-adapter-slowdebug-1:25.0.3.0.9-1.el10_2, java-25-openjdk-demo-fastdebug-1:25.0.3.0.9-1.el10_2 +13
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-25-openjdk-crypto-adapter-fastdebug-1:25.0.3.0.9-1.el9, java-25-openjdk-crypto-adapter-slowdebug-1:25.0.3.0.9-1.el9, java-25-openjdk-demo-fastdebug-1:25.0.3.0.9-1.el9 +13
  • RHSA-2026:9255 Released 2026-04-22 · Red Hat rating Important
    OpenJDK 11.0.31 ELS Security Update for Portable Linux Builds
    • OPENJDK ELS 11.0.31
  • RHSA-2026:9254 Released 2026-04-22 · Red Hat rating Important
    Java 11 OpenJDK ELS Security Update
    • Red Hat OpenJDK 11 ELS for RHEL 7 java-11-openjdk-1:11.0.31.0.11-1.el7_9, java-11-openjdk-debug-1:11.0.31.0.11-1.el7_9, java-11-openjdk-demo-1:11.0.31.0.11-1.el7_9 +15
    • Red Hat OpenJDK 11 ELS for RHEL 8 java-11-openjdk-1:11.0.31.0.11-1.el8, java-11-openjdk-demo-1:11.0.31.0.11-1.el8, java-11-openjdk-demo-fastdebug-1:11.0.31.0.11-1.el8 +20
    • Red Hat OpenJDK 11 ELS for RHEL 9 java-11-openjdk-1:11.0.31.0.11-1.el9, java-11-openjdk-demo-1:11.0.31.0.11-1.el9, java-11-openjdk-demo-fastdebug-1:11.0.31.0.11-1.el9 +20
  • RHSA-2026:9638 Released 2026-04-22 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 10) thunderbird-140.9.1-1.el10_1
  • RHSA-2026:9345 Released 2026-04-21 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 8) thunderbird-140.9.1-1.el8_10
  • RHSA-2026:8459 Released 2026-04-16 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 9) thunderbird-140.9.1-1.el9_7
  • RHSA-2026:8052 Released 2026-04-14 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream (v. 8) firefox-140.9.1-1.el8_10
  • RHSA-2026:7671 Released 2026-04-13 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream (v. 9) firefox-140.9.1-1.el9_7, firefox-x11-140.9.1-1.el9_7
  • RHSA-2026:7672 Released 2026-04-13 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AppStream (v. 10) firefox-140.9.1-1.el10_1
  • RHSA-2026:6732 Released 2026-04-07 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libpng-1.6.56-1.hum1@aarch64, libpng-1.6.56-1.hum1@src, libpng-1.6.56-1.hum1@x86_64 +6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat build of OpenJDK 1.8AffectedNo fix yet
Red Hat build of OpenJDK 11 ELSAffectedNo fix yet
Red Hat build of OpenJDK 17AffectedNo fix yet
Red Hat build of OpenJDK 21AffectedNo fix yet
OPENJDK ELS 11.0.31Fixed RHSA-2026:9255
Red Hat AI Inference Server 3.2Fixed RHSA-2026:25096
Red Hat Build of OpenJDK 17.0.9Fixed RHSA-2026:9687
Red Hat Build of OpenJDK 21.0.11Fixed RHSA-2026:9690
Red Hat Build of OpenJDK 25.0.3Fixed RHSA-2026:9694
Red Hat Build of OpenJDK 8u492Fixed RHSA-2026:9684
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Discovery 2Fixed RHSA-2026:33313
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:14790, RHSA-2026:28233, RHSA-2026:7672, RHSA-2026:9638, RHSA-2026:9689, RHSA-2026:9693
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:8052, RHSA-2026:9345, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:14791, RHSA-2026:28255, RHSA-2026:7671, RHSA-2026:8459, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689, RHSA-2026:9693
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2026:11805, RHSA-2026:9683
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:13600, RHSA-2026:14303, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:13683, RHSA-2026:15889, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:13683, RHSA-2026:15889, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:13682, RHSA-2026:14223, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:12264, RHSA-2026:13596, RHSA-2026:17685, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:13412, RHSA-2026:13922, RHSA-2026:17642, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:11813, RHSA-2026:13665, RHSA-2026:17567, RHSA-2026:9689
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:13533, RHSA-2026:13582, RHSA-2026:17603, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:13342, RHSA-2026:13583, RHSA-2026:17524, RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:13600, RHSA-2026:14303, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:13683, RHSA-2026:15889, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:13682, RHSA-2026:14223, RHSA-2026:9683, RHSA-2026:9686
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:14790, RHSA-2026:28233
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:14791, RHSA-2026:28255
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2026:17685
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:17642
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:17567
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2026:17603
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:17524
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:9689, RHSA-2026:9693
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:9683, RHSA-2026:9686, RHSA-2026:9689, RHSA-2026:9693
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:9689
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:13977
Red Hat Hardened ImagesFixed RHSA-2026:6732, RHSA-2026:80330
Red Hat OpenJDK 11 ELS for RHEL 7Fixed RHSA-2026:9254
Red Hat OpenJDK 11 ELS for RHEL 8Fixed RHSA-2026:9254
Red Hat OpenJDK 11 ELS for RHEL 9Fixed RHSA-2026:9254
Red Hat OpenShift AI 3.4Fixed RHSA-2026:74674
Not affected: 15 products
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0)
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6)
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33636
  2. 2026-10-09 Fix available: RHSA-2026:9255 · Red Hat
  3. 2026-10-11 Fix available: OPENJDK ELS 11.0.31 · Red Hat
  4. 2026-10-12 Fix available: RHSA-2026:80330 · Red Hat
  5. 2026-10-12 Affected versions changed · Red Hat
  6. 2026-10-25 EPSS moved to the 50th–90th percentile
  7. 2026-10-30 Fix available: RHSA-2026:9684 · Red Hat
  8. 2026-10-30 Fix available: RHSA-2026:9694 · Red Hat
  9. 2026-10-30 Fix available: RHSA-2026:9690 · Red Hat
  10. 2026-10-30 Fix available: Red Hat Build of OpenJDK 21.0.11, Red Hat Build of OpenJDK 25.0.3, Red Hat Build of OpenJDK 8u492 · Red Hat
  11. 2026-10-31 Fix available: RHSA-2026:9687 · Red Hat
  12. 2026-10-31 Fix available: Red Hat Build of OpenJDK 17.0.9 · Red Hat

References

Patch 3

  • TI-2011-02683 Integer signedness error in the png_inflate function in pngrutil.c in libpng before… CVSS 3.1HIGH 8.8
  • TI-2010-01161 Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in… CVSS 3.1CRITICAL 9.8
  • TI-2026-20746 LIBPNG has a heap buffer overflow in png_set_quantize CVSS 4.0HIGH 8.3
  • TI-2025-40204 LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read` CVSS 3.1HIGH 7.1
  • TI-2025-40767 LIBPNG has an out-of-bounds read in png_image_read_composite CVSS 3.1HIGH 7.1
  • TI-2025-40066 LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication CVSS 3.1HIGH 7.1
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences