Fluid Attacks Database

Description

LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to png_process_data. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	libpng1.6	=1.6.37-3 \|\| =1.6.37-3+deb11u1 \|\| =1.6.37-3+deb11u2 \|\| =1.6.37-3+deb11u3 \|\| =1.6.37-3+deb11u4 \|\| =1.6.37-4 \|\| =1.6.37-5 \|\| =1.6.38-1 \|\| =1.6.38-2 \|\| =1.6.39-1 \|\| =1.6.39-2 \|\| =1.6.40-1 \|\| =1.6.40-2 \|\| =1.6.40-3 \|\| =1.6.41-1 \|\| =1.6.42-1 \|\| =1.6.42-1.1~exp1 \|\| =1.6.43-1 \|\| =1.6.43-1exp1 \|\| =1.6.43-2 \|\| =1.6.43-3 \|\| =1.6.43-4 \|\| =1.6.43-5 \|\| =1.6.44-1 \|\| =1.6.44-2 \|\| =1.6.44-3 \|\| =1.6.45-1 \|\| =1.6.46-1 \|\| =1.6.46-2 \|\| =1.6.46-3 \|\| =1.6.46-4 \|\| =1.6.47-1 \|\| =1.6.47-1.1 \|\| =1.6.48-1 \|\| =1.6.49-1~exp1 \|\| =1.6.50-1 \|\| =1.6.50-1~exp1 \|\| =1.6.51-1 \|\| =1.6.52-1 \|\| =1.6.53-1 \|\| =1.6.54-1 \|\| =1.6.55-1 \|\| =1.6.56-1 \|\| =1.6.57-1 \|\| =1.6.58-1	-
debian 13	libpng1.6	>=0 <1.6.37-4	1.6.37-4
debian 14	libpng1.6	>=0 <1.6.37-4	1.6.37-4
alpine v3.23	libpng	>=0 <1.6.58-r1	1.6.58-r1
debian 12	libpng1.6	>=0 <1.6.37-4	1.6.37-4

Aliases

1. CVE-2026-409302. NVD-2026-409303. OSV-DEBIAN-2026-409304. OSV-2026-409305. OSV-ALPINE-2026-409306. SECURITY-TRACKER-CVE-2026-409307. SECURITY-CVE-2026-40930