Back Linuxsecurity

Mageia 9 libpng Important Use-After-Free and OOB Read MGASA-2026

Linuxsecurity •LinuxSecurity Advisories • March 28, 2026

Description: Use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE. (CVE-2026-33416) Out-of-bounds read/write in the palette expansion on ARM Neon. (CVE-2026-33636)

- - - -

MGASA-2026-0070 - Updated libpng packages fix security vulnerabilities

- 9/core/libpng-1.6.38-1.5.mga9

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mageia 9 Vulnerabilities in GraphicsMagick and libpng Addressed Recent updates to Mageia 9 have addressed critical vulnerabilities in GraphicsMagick and libpng. GraphicsMagick was found to have a stack write buffer overflow (CVE-2026-28690) and a heap overflow (CVE-2026-30883), both published on 2026-03-09. These vulnerabilities could be exploited to execute arbitrary code or crash applications. Additionally, libpng has been updated to fix a use-after-free vulnerability (CVE-2026-33416) and an out-of-bounds read/write issue (CVE-2026-33636), published on 2026-03-26. The vulnerabilities affect users of Mageia 9 who utilize these libraries for image processing. Users are advised to update their packages to mitigate potential exploitation risks. The updates are part of ongoing efforts to secure the Mageia operating system against emerging threats. 2 sources 58

Extracted Entities

CVEs (2)

CVE-2026-33416 CVE-2026-33636