Re: libpng security issue that affects TeX Live 2026

> Nelson H. F. Beebe wrote:
> 
> There is a new security bulletin for libpng (see below). [...]
> 
> >> - -------------------------------------------------------------------------
> >> Debian Security Advisory DSA-6138-1 security at debian.org
> >> https://www.debian.org/security/ Moritz Muehlenhoff
> >> February 17, 2026 https://www.debian.org/security/faq
> >> - -------------------------------------------------------------------------
> >> 
> >> Package : libpng1.6
> >> CVE ID : CVE-2026-25646
> >> 
> >> A buffer overflow was discovered in libpng, a library implementing an
> >> interface for reading and writing PNG (Portable Network Graphics) files,
> >> which could result in denial of service or potentially the execution
> >> of arbitrary code.
> >> 
> >> [...]
> >> 
> >> We recommend that you upgrade your libpng1.6 packages.

Based on <https://www.libpng.org/pub/png/libpng.html>, the version of libpng that fixes the vulnerability is 1.6.55, released on February 9, 2026.

This version has been included in the TeX Live sources on February 10:

	https://svn.tug.org:8369/texlive?revision=77713&view=revision

So this would mean the latest builds are immune, provided the link to libpng is static.

It seems so. Here on the Mac, applying "grep -l libpng *" to universal-darwin and removing the symlinks leaves

	dvipng
	luahbtex
	luajithbtex
	luajittex
	luatex
	mpost
	pdftex
	pmpost
	upmpost
	xdvipdfmx
	xdvipsk
	xetex

Then:

	% luatex --credits
	This is LuaTeX, Version 1.24.0 (TeX Live 2026)
	[...]
	Compiled with libpng 1.6.55; using 1.6.55

	% mpost --version
	MetaPost 3.00 (TeX Live 2026) (kpathsea version 6.4.2)
	[...]
	Compiled with libpng 1.6.55; using 1.6.55

	% pdftex --version
	pdfTeX 3.141592653-2.6-1.40.29 (TeX Live 2026)
	[...]
	Compiled with libpng 1.6.55; using libpng 1.6.55

	% xetex --version
	XeTeX 3.141592653-2.6-0.999998 (TeX Live 2026)
	[...]
	Compiled with libpng version 1.6.55; using 1.6.55

I don't know how to get the same info forhe other binaries.

The link here is necessarily static, as macOS doesn't include libpng. (And I double-checked, applying "otool -L" to each of the binaries, to list the shared binaries they use.)

Similarly, libpng has been updated to 1.6.55 in the Ghostscript sources on February 16:

	https://github.com/ArtifexSoftware/ghostpdl/commit/82e5ca75e9b57bd3aea51e034a8efcafc6b37cad

So the next release 10.07.0 will be immune too. For the TL distributions that include Ghostscript (Windows, Mac): the preparation of 10.07.0 (betas or rcs) is expected to begin in a week or so.

Bruno Voisin