CVE-2026-34757: LIBPNG Use-After-Free Vulnerability

CVE-2026-34757 Overview

CVE-2026-34757 is a Use After Free vulnerability affecting libpng, the reference library for reading, creating, and manipulating PNG (Portable Network Graphics) raster image files. The vulnerability exists in versions 1.0.9 through 1.6.56 and occurs when a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST is passed back into the corresponding setter function on the same png_struct/png_info pair.

Critical Impact
Exploitation of this vulnerability can lead to information disclosure through heap content leakage or silent data corruption in PNG chunk metadata, potentially affecting any application that processes PNG images using vulnerable libpng versions.

Affected Products

libpng versions 1.0.9 through 1.6.56
Applications using libpng for PNG image processing
Software libraries and frameworks depending on libpng

Discovery Timeline

April 9, 2026 - CVE-2026-34757 published to NVD
April 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-34757

Vulnerability Analysis

This Use After Free vulnerability (CWE-416) occurs in libpng's chunk metadata handling functions. The flaw is triggered when an application retrieves a pointer to internal buffer data using getter functions (png_get_PLTE, png_get_tRNS, or png_get_hIST) and subsequently passes that same pointer back to the corresponding setter function.

The vulnerability requires local access and no privileges to exploit. When triggered, the freed memory region may contain stale data resulting in silently corrupted chunk metadata, or it may contain data from subsequent heap allocations, leading to unrelated heap contents being leaked into the chunk structure. This creates both data integrity and confidentiality concerns for affected applications.

Root Cause

The root cause lies in the order of operations within the setter functions. When a setter is called, it frees the internal buffer before copying data from the caller-supplied pointer. If the caller-supplied pointer points to the same memory region that was just freed (because it was obtained from the getter), this creates a dangling pointer situation. The setter then reads from freed memory and copies potentially corrupted or unrelated data into the replacement buffer.

Attack Vector

The attack vector is local, requiring an attacker to influence how an application processes PNG files. An attacker could exploit this vulnerability by:

Crafting a malicious PNG file that triggers specific getter-to-setter patterns in vulnerable applications
Causing the application to read chunk data via getter functions
Triggering the application to pass the retrieved pointer back to the setter
Exploiting the resulting memory corruption for information disclosure or data manipulation

The fix introduces proper handling for self-referencing pointers in getter-to-setter aliasing scenarios:

    png_const_textp text_ptr, int num_text)
{
   int i;
+   png_textp old_text = NULL;

   png_debug1(1, "in text storage function, chunk typeid = 0x%lx",
      png_ptr == NULL ? 0xabadca11UL : (unsigned long)png_ptr->chunk_name);

Source: GitHub Commit

The patch adds a new test program to verify the fix:

text

set(pngstest_sources
    contrib/libtests/pngstest.c
)
+set(pnggetset_sources
+    contrib/libtests/pnggetset.c
+)
set(pngunknown_sources
    contrib/libtests/pngunknown.c
)

Source: GitHub Commit

Detection Methods for CVE-2026-34757

Indicators of Compromise

Unexpected memory access patterns in applications processing PNG files
Corrupted PNG chunk metadata in output files
Memory debugging tools (Valgrind, AddressSanitizer) reporting use-after-free errors during PNG processing
Anomalous heap behavior when applications call libpng getter/setter functions in sequence

Detection Strategies

Deploy memory sanitization tools (ASan, MSan) in development and testing environments to detect use-after-free conditions
Monitor applications using libpng for unusual memory access patterns or crashes during PNG processing
Implement static code analysis to identify patterns where getter results are passed directly to setters
Use SentinelOne's Singularity platform to detect memory corruption exploitation attempts

Monitoring Recommendations

Enable heap debugging and memory tracking for applications processing untrusted PNG files
Log and alert on crashes or exceptions in image processing pipelines
Monitor for applications making repeated calls to png_get_PLTE, png_get_tRNS, or png_get_hIST followed by corresponding setters

How to Mitigate CVE-2026-34757

Immediate Actions Required

Upgrade libpng to version 1.6.57 or later immediately
Audit application code for patterns that pass getter results directly to setters
Implement input validation for PNG files from untrusted sources
Consider sandboxing image processing operations until patches can be applied

Patch Information

The vulnerability is fixed in libpng version 1.6.57. The patch properly handles self-referencing pointers in getter-to-setter aliasing scenarios by preserving the old buffer reference before freeing. Detailed patch commits are available in the GitHub Security Advisory GHSA-6fr7-g8h7-v645.

Related issues and patches:

Workarounds

Avoid passing pointers obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST directly back to their corresponding setters
Copy data from getter results to a separate buffer before passing to setter functions
Implement application-level bounds checking on PNG chunk operations

bash

# Verify installed libpng version
pkg-config --modversion libpng
# Expected output for patched version: 1.6.57 or higher

# Check for vulnerable library in linked applications
ldd /path/to/application | grep libpng