{"id":"CVE-2026-58936","kind":"vulnerability","aliases":["CVE-2026-58936"],"related":[],"title":"libpng: use-after-free in png_set_tRNS allows remote code execution","description":"In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"libpng's png_set_tRNS function in pngset.c has a use-after-free that corrupts memory. According to the description, an attacker can reach remote code execution with no extra privileges and no user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","image-processing","libpng","package"],"not_affected_if":["no-untrusted-png-input"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:17:50+00:00","first_seen_at":"2026-11-02T20:35:32+00:00","triaged_at":"2026-11-02T20:38:45+00:00","updated_at":"2026-11-02T20:38:45+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-02T20:38:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"libpng: use-after-free in png_set_tRNS allows remote code execution","impact":"high","summary":"libpng's png_set_tRNS function in pngset.c has a use-after-free that corrupts memory. According to the description, an attacker can reach remote code execution with no extra privileges and no user interaction.","audience":"developers","category":"package","nicknames":[],"who_cares":["libpng","c","image-processing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote code execution with no extra privileges needed.","analyst_note":"Find the affected and fixed libpng versions and any triggering conditions in the NVD entry or the libpng advisory; the sources given state neither.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-png-input"],"who_is_affected":"Applications that link against libpng and process PNG images, especially ones that accept images from untrusted sources, are the likely exposure. The sources do not list affected or fixed libpng versions, so unknown. Teams that never parse PNG input from outside can deprioritize it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000632,"input_tokens":4085,"output_tokens":447,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-58936':16A,19A 'accord':43B 'addit':90C 'allow':10A 'attack':48B 'c':20B 'code':12A,52B,86C 'corrupt':41B,73C 'could':82C 'cve':14A,17A 'descript':46B 'due':74C 'execut':13A,53B,87C,91C 'exploit':100C 'extra':56B 'free':5A,39B,80C 'function':31B 'imag':22B 'image-process':21B 'interact':61B,95C 'lead':83C 'libpng':1A,24B,26B 'memori':42B,72C 'need':93C,98C 'packag':25B 'png':7A,28B,63C 'pngset.c':33B,67C 'possibl':71C 'privileg':57B,92C 'process':23B 'reach':50B 'remot':11A,51B,85C 'set':8A,29B,64C 'trns':9A,30B,65C 'use':3A,37B,78C 'use-after-fre':2A,36B,77C 'user':60B,94C","nicknames":[],"mitigations":[],"who_affected":"Applications that link against libpng and process PNG images, especially ones that accept images from untrusted sources, are the likely exposure. The sources do not list affected or fixed libpng versions, so unknown. Teams that never parse PNG input from outside can deprioritize it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c","imageprocessing","libpng","package","unknown"],"first_public_at":"2026-11-02T20:17:50+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58936","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58936","severity":null,"published_at":"2026-11-02T20:17:50+00:00","modified_at":"2026-11-02T20:17:50+00:00","first_seen_at":"2026-11-02T20:35:32+00:00","fetched_at":"2026-11-02T20:35:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}