CVE-2026-46675

A flaw was found in libpng. A remote attacker could exploit this vulnerability to cause a Denial of Service (DoS) by supplying a specially crafted PNG image. Incomplete decompression of certain metadata chunks can leave a dangling pointer in the library's internal decompression state. When an application finishes processing without reading the image rows, libpng attempts to read from this invalid memory location, resulting in an application crash.

This vulnerability is rated as Moderate because its impact is restricted to application crashes rather than arbitrary code execution or data exposure, as the invalid memory dereference is strictly read-only and discarded. In standard deployments across Red Hat environments, typical software parses complete image structures rather than invoking cleanup routines prior to row processing, significantly limiting real-world exposure. Therefore, the risk is confined to a denial-of-service condition against custom or non-standard consumer applications utilizing this specific sequential reading sequence.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.