libpng Vulnerabilities Allow Remote Code Execution and Denial of Service

CERT-Bund has released a security advisory (WID-SEC-2026-0870) detailing critical vulnerabilities in the libpng library, specifically affecting versions prior to 1.6.56. These vulnerabilities have a CVSS Base Score of 7.6 (High) and a Temporal Score of 6.6 (Medium), indicating a significant risk. Remote, anonymous attackers can exploit these flaws to achieve arbitrary code execution or launch denial-of-service attacks on affected systems, which include Linux, UNIX, Windows, and other operating systems.

Organizations utilizing the libpng library, particularly those involved in software development or distribution, must update to a patched version (1.6.56 or later) to mitigate these risks. While the advisory provides mitigation details, the primary action is to upgrade the libpng library. Failure to do so could result in system compromise or service disruption. The advisory was published on March 25, 2026, with an update on March 26, 2026.