CVE-2026-34757: LIBPNG Use-After-Free Vulnerability

CVE-2026-34757 Overview

CVE-2026-34757 is a Use After Free vulnerability affecting libpng, the reference library for reading, creating, and manipulating PNG (Portable Network Graphics) raster image files. The vulnerability exists in versions 1.0.9 through 1.6.56 and occurs when a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST is passed back into the corresponding setter function on the same png_struct/png_info pair.

Critical Impact

Exploitation of this vulnerability can lead to information disclosure through heap content leakage or silent data corruption in PNG chunk metadata, potentially affecting any application that processes PNG images using vulnerable libpng versions.

Affected Products

• libpng versions 1.0.9 through 1.6.56
• Applications using libpng for PNG image processing
• Software libraries and frameworks depending on libpng

Discovery Timeline

• April 9, 2026 - CVE-2026-34757 published to NVD
• April 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-34757

Vulnerability Analysis

This Use After Free vulnerability (CWE-416) occurs in libpng's chunk metadata handling functions. The flaw is triggered when an application retrieves a pointer to internal buffer data using getter functions (png_get_PLTE, png_get_tRNS, or png_get_hIST) and subsequently passes that same pointer back to the corresponding setter function.

The vulnerability requires local access and no privileges to exploit. When triggered, the freed memory region may contain stale data resulting in silently corrupted chunk metadata, or it may contain data from subsequent heap allocations, leading to unrelated heap contents being leaked into the chunk structure. This creates both data integrity and confidentiality concerns for affected applications.

Root Cause

The root cause lies in the order of operations within the setter functions. When a setter is called, it frees the internal buffer before copying data from the caller-supplied pointer. If the caller-supplied pointer points to the same memory region that was just freed (because it was obtained from the getter), this creates a dangling pointer situation. The setter then reads from freed memory and copies potentially corrupted or unrelated data into the replacement buffer.

Attack Vector

The attack vector is local, requiring an attacker to influence how an application processes PNG files. An attacker could exploit this vulnerability by:

1. Crafting a malicious PNG file that triggers specific getter-to-setter patterns in vulnerable applications
2. Causing the application to read chunk data via getter functions
3. Triggering the application to pass the retrieved pointer back to the setter
4. Exploiting the resulting memory corruption for information disclosure or data manipulation

The fix introduces proper handling for self-referencing pointers in getter-to-setter aliasing scenarios:

    png_const_textp text_ptr, int num_text)
{
   int i;
+   png_textp old_text = NULL;

   png_debug1(1, "in text storage function, chunk typeid = 0x%lx",
      png_ptr == NULL ? 0xabadca11UL : (unsigned long)png_ptr->chunk_name);

Source: GitHub Commit

The patch adds a new test program to verify the fix:

set(pngstest_sources
    contrib/libtests/pngstest.c
)
+set(pnggetset_sources
+    contrib/libtests/pnggetset.c
+)
set(pngunknown_sources
    contrib/libtests/pngunknown.c
)

Source: GitHub Commit

Detection Methods for CVE-2026-34757

Indicators of Compromise

• Unexpected memory access patterns in applications processing PNG files
• Corrupted PNG chunk metadata in output files
• Memory debugging tools (Valgrind, AddressSanitizer) reporting use-after-free errors during PNG processing
• Anomalous heap behavior when applications call libpng getter/setter functions in sequence

Detection Strategies

• Deploy memory sanitization tools (ASan, MSan) in development and testing environments to detect use-after-free conditions
• Monitor applications using libpng for unusual memory access patterns or crashes during PNG processing
• Implement static code analysis to identify patterns where getter results are passed directly to setters
• Use SentinelOne's Singularity platform to detect memory corruption exploitation attempts

Monitoring Recommendations

• Enable heap debugging and memory tracking for applications processing untrusted PNG files
• Log and alert on crashes or exceptions in image processing pipelines
• Monitor for applications making repeated calls to png_get_PLTE, png_get_tRNS, or png_get_hIST followed by corresponding setters

How to Mitigate CVE-2026-34757

Immediate Actions Required

• Upgrade libpng to version 1.6.57 or later immediately
• Audit application code for patterns that pass getter results directly to setters
• Implement input validation for PNG files from untrusted sources
• Consider sandboxing image processing operations until patches can be applied

Patch Information

The vulnerability is fixed in libpng version 1.6.57. The patch properly handles self-referencing pointers in getter-to-setter aliasing scenarios by preserving the old buffer reference before freeing. Detailed patch commits are available in the GitHub Security Advisory GHSA-6fr7-g8h7-v645.

Related issues and patches:

• GitHub Issue #836
• GitHub Issue #837

Workarounds

• Avoid passing pointers obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST directly back to their corresponding setters
• Copy data from getter results to a separate buffer before passing to setter functions
• Implement application-level bounds checking on PNG chunk operations

# Verify installed libpng version
pkg-config --modversion libpng
# Expected output for patched version: 1.6.57 or higher

# Check for vulnerable library in linked applications
ldd /path/to/application | grep libpng