CVE-2026-34757: 
NixOS vulnerability analysis and mitigation

CVE-2026-34757 is a use-after-free vulnerability in libpng affecting versions 1.0.9 through 1.6.56, the widely used reference library for reading, creating, and manipulating PNG image files. The flaw occurs when a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST is passed back into the corresponding setter function on the same png_struct/png_info pair, causing the setter to read from freed heap memory. It was reported on March 28, 2026, publicly disclosed on April 9, 2026, and fixed in libpng 1.6.57. The CVSS v3.1 base score is 4.4 (Medium) per NVD, and 5.1 (Medium) per the GitHub Security Advisory (GitHub Advisory, Red Hat CVE).

The root cause is a use-after-free (CWE-416) combined with an expired pointer dereference (CWE-825) in pngset.c. The getter functions (png_get_PLTE, png_get_tRNS, png_get_hIST) return raw internal pointers directly to the caller rather than copies. When the caller passes these pointers back into the corresponding setters, the setter first frees the internal buffer (via png_free_data) and then attempts to memcpy from the now-dangling caller-supplied pointer — which aliases the just-freed memory. The freed region may contain stale data, producing silently corrupted chunk metadata, or data from subsequent heap allocations, leaking unrelated heap contents. Notably, the png_set_PLTE and png_set_tRNS defects are regressions introduced by the CVE-2026-33416 fix in libpng 1.6.56, while the png_set_hIST defect has existed since at least libpng 1.0.9 (2001). The vulnerability cannot be triggered by a crafted PNG file alone — it requires the application to call the getter and then pass the returned pointer to the setter on the same struct pair (GitHub Advisory, Issue #836).

Successful exploitation results in two primary consequences: heap information disclosure (confidentiality impact) and PNG chunk metadata corruption (integrity impact). An attacker or a malicious application that can influence how a libpng-consuming application processes PNG chunk data may cause the application to copy stale or unrelated heap contents into newly allocated chunk structures, potentially leaking sensitive in-process memory such as heap allocator metadata or other application data. There is no availability impact (no crash in non-sanitized builds under normal conditions), and exploitation is limited to local context — it cannot be triggered remotely by a crafted PNG file without application-level cooperation in the getter-to-setter pattern (GitHub Advisory, Issue #837).

Public proof-of-concept (PoC) code is available in two GitHub issues (#836 and #837), demonstrating heap-use-after-free crashes confirmed under AddressSanitizer for both the png_set_PLTE and png_set_tRNS cases. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), reflecting very low probability of exploitation in the near term (GitHub Advisory, Issue #836, Issue #837).

1. Identify a vulnerable application: Locate a software application that uses libpng versions 1.0.9–1.6.56 and exposes a code path where PNG chunk getter and setter functions are called in sequence on the same png_struct/png_info pair (e.g., a PNG transcoder, image editor, or wrapper library).
2. Trigger the getter: Cause the application to call png_get_PLTE, png_get_tRNS, or png_get_hIST on a PNG image that contains the relevant chunk (PLTE, tRNS, or hIST). Any valid PNG with the relevant chunk is sufficient — the image does not need to be malformed.
3. Pass the returned pointer to the setter: Ensure the application (or craft a scenario where) the pointer returned by the getter is passed directly back into the corresponding setter (png_set_PLTE, png_set_tRNS, or png_set_hIST) on the same struct pair, following a natural "get, inspect, set back" pattern.
4. Trigger the use-after-free: The setter frees the internal buffer and then performs a memcpy from the now-dangling pointer. Under AddressSanitizer, this produces an immediate crash; in production builds, it results in undefined behavior — either silently corrupted chunk metadata or heap content disclosure into the chunk struct.
5. Observe or exploit the outcome: In a memory-disclosure scenario, the corrupted chunk data (now containing stale or unrelated heap contents) may be written to an output PNG file or returned to the caller, potentially leaking sensitive heap memory (Issue #836, Issue #837).

The primary remediation is to upgrade libpng to version 1.6.57 or later, which snapshots the caller's data into a stack-local buffer before freeing old internal storage, eliminating the use-after-free. The fix is implemented in commits 398cbe3 (main fix for PLTE, tRNS, hIST) and 55d20aa (follow-up hardening for append-style setters). As a workaround, applications should avoid passing a pointer returned by a getter directly back into the corresponding setter on the same struct pair; instead, copy the getter's output into a caller-owned buffer and pass the copy to the setter. Downstream distributions including Debian, Ubuntu (USN-8251-1), SUSE, openSUSE, Red Hat (RHSA-2026:13719), Amazon Linux, and Slackware have issued updated packages (GitHub Advisory, Red Hat Errata).

The vulnerability was reported by researcher Iv4n550 and remediated by libpng maintainer ctruta (Cosmin Truta). Microsoft acknowledged the vulnerability in their MSRC update guide, noting it affects the azl3_libpng_1.6.56-1 package in Azure Linux 3. Multiple Linux distributions (Debian, Ubuntu, SUSE, openSUSE, Red Hat, Amazon Linux, Slackware, Fedora) issued security advisories and updated packages within weeks of disclosure. The oss-security mailing list carried the initial disclosure, and the vulnerability received coverage in Linux security news outlets and community forums (Microsoft MSRC, Red Hat CVE).