Oracle Linux 8 libpng12 Moderate Use-After-Free Advisory ELSA-2026

Back Linuxsecurity

Oracle Linux 8 libpng12 Moderate Use-After-Free Advisory ELSA-2026

Linuxsecurity •LinuxSecurity Advisories • June 18, 2026

Share: View original

[1.2.57-7] - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161345)

[1.2.57-7] - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161345)

libpng12-1.2.57-7.el8_10.i686.rpm libpng12-1.2.57-7.el8_10.x86_64.rpm

libpng12-1.2.57-7.el8_10.i686.rpm libpng12-1.2.57-7.el8_10.x86_64.rpm

libpng12-1.2.57-7.el8_10.aarch64.rpm

libpng12-1.2.57-7.el8_10.aarch64.rpm

Related CVEs: CVE-2026-33416

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle Linux 8 Vulnerability Advisory for libpng12 and libpng15 Oracle has issued advisories for two vulnerabilities in Oracle Linux 8 affecting libpng12 and libpng15. Both advisories address CVE-2026-33416, a use-after-free vulnerability due to pointer aliasing in the png_set_tRNS and png_set_PLTE functions. The affected versions include libpng12-1.2.57-7 and libpng15-1.5.30-9. Users of Oracle Linux 8 are urged to update their systems to mitigate potential exploitation. The vulnerabilities were published on March 26, 2026, and are considered moderate in severity. The patch includes updates for multiple architectures, including i686, x86_64, and aarch64. No active exploitation has been reported at this time, but users should prioritize applying the updates. 3 sources 46

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Cwe-416 - Use After Free

Platforms (2)

Linux Oracle Linux