CLSA-2026-1791824192
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1791824192.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1791824192
- Upstream
- CVE-2026-46675
- Published
- 2026-10-12T16:56:43Z
- Modified
- 2026-10-26T09:32:06Z
- Summary
- Fix CVE(s): CVE-2026-46675
- Details
-
- SECURITY UPDATE: use-after-free through stale zstream pointers
- debian/patches/CVE-2026-46675.patch: add png_inflate_detach_buffers to clear the zstream input and output pointers and counters, and call it on claim in png_inflate_claim and on release in png_decompress_chunk, png_handle_iCCP and png_read_finish_IDAT (pngrutil.c), so that png_read_end called before row reading no longer inflates through a stale next_in into a freed buffer
- CVE-2026-46675
- SECURITY UPDATE: use-after-free through stale zstream pointers
- References
Affected packages
TuxCare:Ubuntu:20.04 / libpng-dev
Package
- Name
- libpng-dev
- Purl
- pkg:deb/tuxcare/libpng-dev?distro=ubuntu-20.04
TuxCare:Ubuntu:20.04 / libpng-tools
Package
- Name
- libpng-tools
- Purl
- pkg:deb/tuxcare/libpng-tools?distro=ubuntu-20.04