Re: libpng security issue that affects TeX Live 2026

Hi Nelson,

    >> CVE ID         : CVE-2026-25646

As Bruno already mentioned, according to
https://www.libpng.org/pub/png/libpng.html, the latest version 1.6.55
fixes that problem and others, and Akira updated libpng in TL to that
latest version when it came out a week or so. So TL26 should be fine in
this regard. Thank you so much as always, Akira!

	libpng16	xelatex xelatex-dev xetex

libpng is only indirectly dynamically linked into xetex. Running
  readelf -d xetex 2>/dev/null | awk '/NEEDED/ {print $NF}'
shows the direct dependencies, which does not include libpng.
(In comparison to ldd, which shows everything.)
(I don't imagine I'm telling you anything you don't already know. :)

xetex is dynamically linked with freetype, which in turn is linked with
libpng, and others. I surmise this is somehow required because of
dynamically linking with fontconfig, though I don't remember any details
and am not finding anything written down about it.

Xetex is also statically linked with the libs/freetype2 in the TL
source tree for the main typesetting stuff. Anyway.

    perhaps means that they use that library, but do so via dynamic
    linking, rather than having -lpng bound to the executable at link
    time.  

Excluding xetex, in the native TL build, there is in general no dynamic
linking apart from the unavoidable libc, libm, fontconfig, libdl, etc.

    Alternatively, they may be statically linked with -lpng, and
    thus, might contain vulnerable code.

Yes, numerous programs in TL are statically linked with png. --thanks, karl.