The new libpng 1.6.56 vs. the old TODO comments that knew
Cosmin Truta <[email protected]> Thu, 26 Mar 2026 03:51:35 +0200
| Newsgroups | gmane.comp.graphics.png.announce |
|---|---|
| Message-ID | <CAAoVtZyAHUQ_wbXaNn0xo+Ysdm31yRy+V7Dziuncvg3Y9TPgGA@mail.gmail.com> |
--===============6211828499268128420== Content-Type: multipart/alternative; boundary="0000000000008c5deb064de3a097" --0000000000008c5deb064de3a097 Content-Type: text/plain; charset="UTF-8" Hello, everyone, libpng 1.6.56 is out, and it's another security release. Two high-severity CVEs this time -- or, in other words, it's "business-as-usual". The first one is a... story. CVE-2026-33416 is a use-after-free vulnerability that has been hiding in the transparency and palette handling code since the 1990s. Two internal buffers were shared between two data structures with independent lifetimes. The code knew this was wrong. A TODO comment said: *"this is a horrible side effect [...] Fix this."* Another one said: *"CONSIDER: Fix this by not sharing the palette in this way."* Nobody fixed it, because the side effects were load-bearing. For about 25 years. (That's 5 years younger than the age of that other bug that we swatted in that other v1.6.55 release.) Two independent researchers, working continents apart and unaware of each other, found it within days of each other. Halil Oktay, somewhere in Poland, discovered the vulnerability and contributed the fix. Ryo Shimada, somewhere in Japan, independently discovered the same vulnerability and demonstrated arbitrary code execution with an RCE exploit. The triggering PNG is 100% standards-compliant. No validator rejects it. No application firewall catches it. Oh, well... The second one is CVE-2026-33636, an out-of-bounds read and write vulnerability in the ARM Neon palette expansion code. This one has been around since libpng 1.6.36. Many thanks to Taegu Ha for reporting it and contributing the fix, from somewhere in Korea. If you process untrusted PNG images with libpng, you need this update. CVE-2026-33416 affects all libpng versions on all platforms. CVE-2026-33636 affects libpng 1.6.36 through 1.6.55, on ARM and AArch64 with Neon enabled. The gory details are available at: https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2 https://github.com/pnggroup/libpng/blob/v1.6.56/ANNOUNCE Beyond the two CVEs, this release carries a batch of fixes and improvements from Halil Oktay, Yuelin Wang, Owen Sanzas, Bob Friesenhahn and Philippe Antoine. The full list is in the ANNOUNCE file. Oh, and about those TODO comments? Those *"Fix this"* notes? Done! Thanks again, Halil, and thank you everyone, for reminding me of this: https://bonkersworld.net/all-engineers-are-the-same --- In the good old tradition of file authentication, here are the SHA-2-256 checksums of the published archive files: libpng-1.6.56.tar.gz 8f91e941a07fb1069ebb3855278f82a849e6af14ca05821e14ec3d5348697ea5 libpng-1.6.56.tar.xz f7d8bf1601b7804f583a254ab343a6549ca6cf27d255c302c47af2d9d36a6f18 lpng1656.7z 5182afbd92d292bf07a5d732a6ecc66d1108c26e44bb7b299537429d5898ac97 lpng1656.zip 1ccf023c5f4ee1a7b75c5624f53acede5066f79b2fb14ddffaa28369adf9baac --- Sincerely, Cosmin (reporting from somewhere in Romania) --0000000000008c5deb064de3a097 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Hello, everyone,<br><br>libpng 1.6.56 is out, and it's= another security release. Two high-severity CVEs this time -- or, in other= words, it's "business-as-usual".<br><br>The first one is a..= . story. CVE-2026-33416 is a use-after-free vulnerability that has been hid= ing in the transparency and palette handling code since the 1990s. Two inte= rnal buffers were shared between two data structures with independent lifet= imes. The code knew this was wrong. A TODO comment said: <i>"this is a= horrible side effect [...] Fix this."</i> Another one said: <i>"= CONSIDER: Fix this by not sharing the palette in this way."</i> Nobody= fixed it, because the side effects were load-bearing. For about 25 years. = (That's 5 years younger than the age of that other bug that we swatted = in that other v1.6.55 release.)<br><br>Two independent researchers, working= continents apart and unaware of each other, found it within days of each o= ther. Halil Oktay, somewhere in Poland, discovered the vulnerability and co= ntributed the fix. Ryo Shimada, somewhere in Japan, independently discovere= d the same vulnerability and demonstrated arbitrary code execution with an = RCE exploit. The triggering PNG is 100% standards-compliant. No validator r= ejects it. No application firewall catches it. Oh, well...<br><br>The secon= d one is CVE-2026-33636, an out-of-bounds read and write vulnerability in t= he ARM Neon palette expansion code. This one has been around since libpng 1= .6.36. Many thanks to Taegu Ha for reporting it and contributing the fix, f= rom somewhere in Korea.<br><br>If you process untrusted PNG images with lib= png, you need this update. CVE-2026-33416 affects all libpng versions on al= l platforms. CVE-2026-33636 affects libpng 1.6.36 through 1.6.55, on ARM an= d AArch64 with Neon enabled.<br><br>The gory details are available at:<br><= br><a href=3D"https://github.com/pnggroup/libpng/security/advisories/GHSA-m= 4pc-p4q3-4c7j">https://github.com/pnggroup/libpng/security/advisories/GHSA-= m4pc-p4q3-4c7j</a><br><a href=3D"https://github.com/pnggroup/libpng/securit= y/advisories/GHSA-wjr5-c57x-95m2">https://github.com/pnggroup/libpng/securi= ty/advisories/GHSA-wjr5-c57x-95m2</a><br><a href=3D"https://github.com/pngg= roup/libpng/blob/v1.6.56/ANNOUNCE">https://github.com/pnggroup/libpng/blob/= v1.6.56/ANNOUNCE</a><br><br>Beyond the two CVEs, this release carries a bat= ch of fixes and improvements from Halil Oktay, Yuelin Wang, Owen Sanzas, Bo= b Friesenhahn and Philippe Antoine. The full list is in the ANNOUNCE file.<= br><br>Oh, and about those TODO comments? Those <i>"Fix this"</i>= notes? Done! Thanks again, Halil, and thank you everyone, for reminding me= of this:<br><a href=3D"https://bonkersworld.net/all-engineers-are-the-same= ">https://bonkersworld.net/all-engineers-are-the-same</a><br><br>---<br><br= >In the good old tradition of file authentication, here are the SHA-2-256 c= hecksums of the published archive files:<br><br>libpng-1.6.56.tar.gz<br>8f9= 1e941a07fb1069ebb3855278f82a849e6af14ca05821e14ec3d5348697ea5<br><br>libpng= -1.6.56.tar.xz<br>f7d8bf1601b7804f583a254ab343a6549ca6cf27d255c302c47af2d9d= 36a6f18<br><br>lpng1656.7z<br>5182afbd92d292bf07a5d732a6ecc66d1108c26e44bb7= b299537429d5898ac97<br><br>lpng1656.zip<br>1ccf023c5f4ee1a7b75c5624f53acede= 5066f79b2fb14ddffaa28369adf9baac<br><br>---<br><br>Sincerely,<br>Cosmin (re= porting from somewhere in Romania)</div> --0000000000008c5deb064de3a097-- --===============6211828499268128420== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============6211828499268128420== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ png-mng-announce mailing list png-mng-announce-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org https://lists.sourceforge.net/lists/listinfo/png-mng-announce --===============6211828499268128420==--