libpng 1.6.59: Use-after-free vulnerability fixed: CVE-2026-46675
libpng 1.6.59 fixes medium-severity use-after-free CVE-2026-46675 in the sequential reader.
Cosmin Truta announced libpng 1.6.59, which fixes CVE-2026-46675, a medium-severity use-after-free of zlib input inside png_read_end. The bug has existed since libpng 1.6.0 and affects applications that call png_read_end after incomplete zTXt, iTXt, or iCCP chunks without first reading image rows. Users should upgrade to 1.6.59 or apply the published fix. The notice does not report active exploitation.
- CVE-2026-46675 is a use-after-free in libpng’s sequential reader.
- Trigger is png_read_end after incomplete zTXt, iTXt, or iCCP data.
- The flaw has been present since libpng 1.6.0.
- Fixed in libpng 1.6.59; no exploitation is reported.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-46675 | — | — | — |
From the original article
Posted by Cosmin Truta on Sep 28 Hello, everyone, libpng 1. 6. 59 has been released, fixing a medium-severity use-after-free vulnerability in the sequential reader, present since libpng 1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.