CVE-2026-33636

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33636
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-33636.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-33636
Aliases
  • GHSA-wjr5-c57x-95m2
Downstream
Published
2026-03-26T16:51:58.289Z
Modified
2026-03-27T11:06:03.243723Z
Severity
  • 7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H CVSS Calculator
Summary
LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64
Details

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without verifying that enough input pixels remain. Because the implementation works backward from the end of the row, the final iteration dereferences pointers before the start of the row buffer (OOB read) and writes expanded pixel data to the same underflowed positions (OOB write). This is reachable via normal decoding of attacker-controlled PNG input if Neon is enabled. Version 1.6.56 fixes the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-125",
        "CWE-787"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33636.json"
}
References

Affected packages

Git / github.com/pnggroup/libpng

Affected ranges

Type
GIT
Repo
https://github.com/pnggroup/libpng
Events
Introduced
eddf9023206dc40974c26f589ee2ad63a4227a1e
Fixed
d5515b5b8be3901aac04e5bd8bd5c89f287bcd33
Database specific 
{
    "versions": [
        {
            "introduced": "1.6.36"
        },
        {
            "fixed": "1.6.56"
        }
    ]
}

Affected versions

v1.*
v1.6.36
v1.6.37
v1.6.38
v1.6.39
v1.6.40
v1.6.41
v1.6.42
v1.6.43
v1.6.44
v1.6.45
v1.6.46
v1.6.47
v1.6.48
v1.6.49
v1.6.50
v1.6.51
v1.6.52
v1.6.53
v1.6.54
v1.6.55

Database specific

vanir_signatures 
[
    {
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/pnggroup/libpng/commit/d5515b5b8be3901aac04e5bd8bd5c89f287bcd33",
        "digest": {
            "line_hashes": [
                "277710390577621166110153611286032748480",
                "37812626001429359030407727102204306192",
                "235108146190051955392336492964133331294",
                "308819439959077714989618121299124277555",
                "260397287775790088579463485285595959002"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "id": "CVE-2026-33636-053d8287",
        "target": {
            "file": "pngtest.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/pnggroup/libpng/commit/d5515b5b8be3901aac04e5bd8bd5c89f287bcd33",
        "digest": {
            "line_hashes": [
                "195793623419483107751349550499422338653",
                "241481619897360395005270248340996576576",
                "333957916052778635910280086895133772621",
                "73182602440664933896353205027083131409",
                "119279519610455638020139458056230155289",
                "215279933436747534013670962459111392399"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "id": "CVE-2026-33636-9a8d3ae7",
        "target": {
            "file": "png.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/pnggroup/libpng/commit/d5515b5b8be3901aac04e5bd8bd5c89f287bcd33",
        "digest": {
            "line_hashes": [
                "166375070723291529406421301066248769034",
                "275647010778297936193963675511576832388",
                "256826767335212246520616614652191899280",
                "279336807821086835335477021495116274772",
                "53629475448747437379627006107537775352",
                "46568612355367798241902050586166833318",
                "245452045998668159989023841863587304868",
                "114709392716353867339954008479701831121"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "id": "CVE-2026-33636-dc375153",
        "target": {
            "file": "png.h"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/pnggroup/libpng/commit/d5515b5b8be3901aac04e5bd8bd5c89f287bcd33",
        "digest": {
            "length": 481.0,
            "function_hash": "241740084829777515414352894687164664979"
        },
        "signature_type": "Function",
        "id": "CVE-2026-33636-ed236551",
        "target": {
            "file": "png.c",
            "function": "png_get_copyright"
        }
    }
]
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-33636.json"