CVE-2026-33636: LIBPNG Buffer Overflow Vulnerability

CVE-2026-33636 Overview

CVE-2026-33636 is an out-of-bounds read and write vulnerability affecting libpng, the reference library for reading, creating, and manipulating PNG (Portable Network Graphics) raster image files. The vulnerability exists in libpng's ARM/AArch64 Neon-optimized palette expansion path and can be triggered through normal decoding of attacker-controlled PNG input when Neon optimization is enabled.

Critical Impact

This vulnerability allows attackers to trigger memory corruption through maliciously crafted PNG files, potentially leading to information disclosure, code execution, or application crashes on ARM/AArch64 systems with Neon optimization enabled.

Affected Products

• libpng versions 1.6.36 through 1.6.55
• Applications using libpng with ARM/AArch64 Neon optimization enabled
• Systems processing untrusted PNG images with vulnerable libpng versions

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-33636 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33636

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-bounds Read) and affects the Neon-optimized code path used for palette expansion on ARM and AArch64 architectures. The flaw manifests when expanding 8-bit paletted rows to RGB or RGBA color formats. The Neon loop processes pixel data in chunks for performance optimization, but the final partial chunk is processed without verifying that sufficient input pixels remain in the buffer.

The vulnerability is particularly dangerous because it can be triggered through normal PNG decoding operations. Any application that processes PNG images from untrusted sources on ARM/AArch64 platforms with Neon support is potentially at risk. The attack requires user interaction (opening or viewing a malicious PNG file), but no authentication or special privileges are needed.

Root Cause

The root cause lies in the backwards-iteration design of the Neon implementation. When processing the final iteration of the palette expansion loop, the code dereferences pointers before the start of the row buffer, resulting in an out-of-bounds read. Subsequently, the expanded pixel data is written to these same underflowed positions, causing an out-of-bounds write. This occurs because the implementation does not properly validate that enough input pixels remain before processing the final partial chunk.

Attack Vector

The attack vector is network-based, requiring an attacker to deliver a specially crafted PNG file to a victim. This can occur through various channels including web pages, email attachments, messaging applications, or any application that processes PNG images. When the vulnerable application attempts to decode the malicious PNG on an ARM/AArch64 system with Neon optimization enabled, the out-of-bounds memory access is triggered.

The vulnerability allows both reading and writing outside the bounds of the allocated row buffer. An attacker could potentially leverage this for information disclosure through the OOB read, or achieve more severe impacts through the OOB write, including memory corruption that could lead to code execution or denial of service.

Detection Methods for CVE-2026-33636

Indicators of Compromise

• Unexpected application crashes when processing PNG files on ARM/AArch64 systems
• Memory corruption signatures in crash dumps related to libpng palette expansion functions
• Abnormal memory access patterns in applications processing PNG images
• Presence of malformed PNG files with unusual palette configurations

Detection Strategies

• Monitor for crashes in applications using libpng on ARM/AArch64 platforms
• Implement file integrity monitoring for incoming PNG files in web applications
• Deploy application crash analysis to identify potential exploitation attempts
• Use memory sanitizers (AddressSanitizer) in development/testing to detect OOB accesses

Monitoring Recommendations

• Enable verbose logging for image processing components
• Monitor system logs for segmentation faults in PNG-processing applications
• Track libpng version inventory across ARM/AArch64 infrastructure
• Implement anomaly detection for image file processing patterns

How to Mitigate CVE-2026-33636

Immediate Actions Required

• Upgrade libpng to version 1.6.56 or later immediately
• Audit all applications that depend on libpng for ARM/AArch64 deployments
• Consider temporarily disabling Neon optimization as a short-term mitigation if patching is delayed
• Restrict processing of PNG files from untrusted sources until patched

Patch Information

The vulnerability has been fixed in libpng version 1.6.56. The fix addresses the boundary checking in the Neon-optimized palette expansion path. Patches are available through the official libpng GitHub repository commits and the additional commit. Organizations should review the GitHub Security Advisory GHSA-wjr5-c57x-95m2 for complete details.

Workarounds

• Disable Neon optimization in libpng compilation if immediate patching is not possible
• Implement input validation to reject suspicious PNG files before processing
• Deploy web application firewalls with deep content inspection for PNG files
• Use sandboxed environments for processing untrusted image files

# Configuration example
# Rebuild libpng without Neon optimization as a temporary workaround
./configure --disable-arm-neon
make
make install

# Verify libpng version after upgrade
pkg-config --modversion libpng

# Check for vulnerable versions in your system
ldconfig -p | grep libpng