SUSE-SU-2026:1368-1

UNKNOWN

Security update for libpng16

Published Apr 15, 2026

Modified 4 days ago

Fix available

Details

This update for libpng16 fixes the following issues:

CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE can lead to arbitrary code execution (bsc#1260754).
CVE-2026-33636: out-of-bounds read/write in the palette expansion on ARM Neon can lead to information leak and crashes (bsc#1260755).

Affected Packages

libpng16

SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6openSUSE Leap 15.6

Fixed in:

1.6.40-150600.3.17.1

libpng16-16

SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6openSUSE Leap 15.6

Fixed in:

1.6.40-150600.3.17.1

libpng16-16-32bit

SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6openSUSE Leap 15.6

Fixed in:

1.6.40-150600.3.17.1

libpng16-compat-devel

SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6openSUSE Leap 15.6

Fixed in:

1.6.40-150600.3.17.1

libpng16-devel

SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6openSUSE Leap 15.6

Fixed in:

1.6.40-150600.3.17.1

libpng16-compat-devel-32bit

openSUSE Leap 15.6

Fixed in:

1.6.40-150600.3.17.1

libpng16-devel-32bit

openSUSE Leap 15.6

Fixed in:

1.6.40-150600.3.17.1

libpng16-tools

openSUSE Leap 15.6