CVE-2026-40930 - LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body

Back Back to CVE browser

MEDIUM

LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body

Published Jun 4, 2026

5.4

MEDIUM

CVSS 3.1

EPSS 0.36%

Description

LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.

Affected products

Vendor Pnggroup Product Libpng Default
n/a
- Version
  = 1.8.0
  Status
  affected
  Constraints
  -
Vendor Pnggroup Product Libpng-Apng Default
n/a
- Version
  >= 1.6.49, <= 1.6.57
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Pnggroup

Libpng

n/a

Version	Status	Constraints
= 1.8.0	affected	-

Pnggroup

Libpng-Apng

n/a

Version	Status	Constraints
>= 1.6.49, <= 1.6.57	affected	-

Red Hat Hardened Images

libpng-main-1.6.58-1.hum1

Fixed · RHSA-2026:20356
Red Hat Enterprise Linux 10

firefox

Fix deferred
Red Hat Enterprise Linux 10

java-21-openjdk

Fix deferred
Red Hat Enterprise Linux 10

java-25-openjdk

Fix deferred
Red Hat Enterprise Linux 10

libpng

Fix deferred
Red Hat Enterprise Linux 10

thunderbird

Fix deferred
Red Hat Enterprise Linux 6

libpng

Fix deferred
Red Hat Enterprise Linux 7

firefox

Fix deferred
Red Hat Enterprise Linux 7

java-1.8.0-openjdk

Fix deferred
Red Hat Enterprise Linux 7

libpng

Fix deferred
Red Hat Enterprise Linux 7

libpng12

Fix deferred
Red Hat Enterprise Linux 8

firefox

Fix deferred
Red Hat Enterprise Linux 8

java-1.8.0-openjdk

Fix deferred
Red Hat Enterprise Linux 8

java-17-openjdk

Fix deferred
Red Hat Enterprise Linux 8

java-21-openjdk

Fix deferred
Red Hat Enterprise Linux 8

libpng

Fix deferred
Red Hat Enterprise Linux 8

libpng12

Fix deferred
Red Hat Enterprise Linux 8

libpng15

Fix deferred
Red Hat Enterprise Linux 8

mingw-libpng

Fix deferred
Red Hat Enterprise Linux 8

thunderbird

Fix deferred
Red Hat Enterprise Linux 9

firefox

Fix deferred
Red Hat Enterprise Linux 9

java-1.8.0-openjdk

Fix deferred
Red Hat Enterprise Linux 9

java-17-openjdk

Fix deferred
Red Hat Enterprise Linux 9

java-21-openjdk

Fix deferred
Red Hat Enterprise Linux 9

java-25-openjdk

Fix deferred
Red Hat Enterprise Linux 9

libpng

Fix deferred
Red Hat Enterprise Linux 9

libpng15

Fix deferred
Red Hat Enterprise Linux 9

thunderbird

Fix deferred
Red Hat Hardened Images

boost

Not affected
Red Hat OpenShift Container Platform 4

openshift/ose-rhel-coreos-8

Fix deferred
Red Hat OpenShift Container Platform 4

openshift/ose-rhel-coreos-9

Fix deferred
Red Hat build of OpenJDK 1.8

java-1.8.0-openjdk-portable

Fix deferred
Red Hat build of OpenJDK 1.8

java-17-openjdk

Fix deferred
Red Hat build of OpenJDK 1.8

java-21-openjdk

Fix deferred
Red Hat build of OpenJDK 1.8

java-21-openjdk-vanilla

Fix deferred
Red Hat build of OpenJDK 11 ELS

java-11-openjdk

Out of support scope
Red Hat build of OpenJDK 11 ELS

java-11-openjdk-portable

Out of support scope
Red Hat build of OpenJDK 11 ELS

java-17-openjdk

Out of support scope
Red Hat build of OpenJDK 11 ELS

java-21-openjdk

Out of support scope
Red Hat build of OpenJDK 11 ELS

java-21-openjdk-vanilla

Out of support scope
Red Hat build of OpenJDK 11 ELS

java-25-openjdk-portable

Out of support scope
Red Hat build of OpenJDK 17

java-17-openjdk

Fix deferred
Red Hat build of OpenJDK 17

java-17-openjdk-portable

Fix deferred
Red Hat build of OpenJDK 17

java-21-openjdk

Fix deferred
Red Hat build of OpenJDK 17

java-21-openjdk-vanilla

Fix deferred
Red Hat build of OpenJDK 17

java-25-openjdk-portable

Fix deferred
Red Hat build of OpenJDK 21

java-17-openjdk

Fix deferred
Red Hat build of OpenJDK 21

java-21-openjdk

Fix deferred
Red Hat build of OpenJDK 21

java-21-openjdk-portable

Fix deferred
Red Hat build of OpenJDK 21

java-21-openjdk-vanilla

Fix deferred
Red Hat build of OpenJDK 21

java-25-openjdk-portable

Fix deferred
Red Hat build of OpenJDK 25

java-25-openjdk-portable

Fix deferred

Product	Package	State	Advisory
Red Hat Hardened Images	libpng-main-1.6.58-1.hum1	Fixed	RHSA-2026:20356
Red Hat Enterprise Linux 10	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 10	java-21-openjdk	Fix deferred	n/a
Red Hat Enterprise Linux 10	java-25-openjdk	Fix deferred	n/a
Red Hat Enterprise Linux 10	libpng	Fix deferred	n/a
Red Hat Enterprise Linux 10	thunderbird	Fix deferred	n/a
Red Hat Enterprise Linux 6	libpng	Fix deferred	n/a
Red Hat Enterprise Linux 7	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 7	java-1.8.0-openjdk	Fix deferred	n/a
Red Hat Enterprise Linux 7	libpng	Fix deferred	n/a
Red Hat Enterprise Linux 7	libpng12	Fix deferred	n/a
Red Hat Enterprise Linux 8	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 8	java-1.8.0-openjdk	Fix deferred	n/a
Red Hat Enterprise Linux 8	java-17-openjdk	Fix deferred	n/a
Red Hat Enterprise Linux 8	java-21-openjdk	Fix deferred	n/a
Red Hat Enterprise Linux 8	libpng	Fix deferred	n/a
Red Hat Enterprise Linux 8	libpng12	Fix deferred	n/a
Red Hat Enterprise Linux 8	libpng15	Fix deferred	n/a
Red Hat Enterprise Linux 8	mingw-libpng	Fix deferred	n/a
Red Hat Enterprise Linux 8	thunderbird	Fix deferred	n/a
Red Hat Enterprise Linux 9	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 9	java-1.8.0-openjdk	Fix deferred	n/a
Red Hat Enterprise Linux 9	java-17-openjdk	Fix deferred	n/a
Red Hat Enterprise Linux 9	java-21-openjdk	Fix deferred	n/a
Red Hat Enterprise Linux 9	java-25-openjdk	Fix deferred	n/a
Red Hat Enterprise Linux 9	libpng	Fix deferred	n/a
Red Hat Enterprise Linux 9	libpng15	Fix deferred	n/a
Red Hat Enterprise Linux 9	thunderbird	Fix deferred	n/a
Red Hat Hardened Images	boost	Not affected	n/a
Red Hat OpenShift Container Platform 4	openshift/ose-rhel-coreos-8	Fix deferred	n/a
Red Hat OpenShift Container Platform 4	openshift/ose-rhel-coreos-9	Fix deferred	n/a
Red Hat build of OpenJDK 1.8	java-1.8.0-openjdk-portable	Fix deferred	n/a
Red Hat build of OpenJDK 1.8	java-17-openjdk	Fix deferred	n/a
Red Hat build of OpenJDK 1.8	java-21-openjdk	Fix deferred	n/a
Red Hat build of OpenJDK 1.8	java-21-openjdk-vanilla	Fix deferred	n/a
Red Hat build of OpenJDK 11 ELS	java-11-openjdk	Out of support scope	n/a
Red Hat build of OpenJDK 11 ELS	java-11-openjdk-portable	Out of support scope	n/a
Red Hat build of OpenJDK 11 ELS	java-17-openjdk	Out of support scope	n/a
Red Hat build of OpenJDK 11 ELS	java-21-openjdk	Out of support scope	n/a
Red Hat build of OpenJDK 11 ELS	java-21-openjdk-vanilla	Out of support scope	n/a
Red Hat build of OpenJDK 11 ELS	java-25-openjdk-portable	Out of support scope	n/a
Red Hat build of OpenJDK 17	java-17-openjdk	Fix deferred	n/a
Red Hat build of OpenJDK 17	java-17-openjdk-portable	Fix deferred	n/a
Red Hat build of OpenJDK 17	java-21-openjdk	Fix deferred	n/a
Red Hat build of OpenJDK 17	java-21-openjdk-vanilla	Fix deferred	n/a
Red Hat build of OpenJDK 17	java-25-openjdk-portable	Fix deferred	n/a
Red Hat build of OpenJDK 21	java-17-openjdk	Fix deferred	n/a
Red Hat build of OpenJDK 21	java-21-openjdk	Fix deferred	n/a
Red Hat build of OpenJDK 21	java-21-openjdk-portable	Fix deferred	n/a
Red Hat build of OpenJDK 21	java-21-openjdk-vanilla	Fix deferred	n/a
Red Hat build of OpenJDK 21	java-25-openjdk-portable	Fix deferred	n/a
Red Hat build of OpenJDK 25	java-25-openjdk-portable	Fix deferred	n/a

Remediation

Red Hat statement

This Moderate flaw in libpng allows a remote attacker to cause a denial of service or unexpected application behavior. By processing a specially crafted Animated Portable Network Graphics (APNG) file, vulnerable applications may misinterpret attacker-controlled data as a new chunk header, leading to resource exhaustion or crashes.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Weaknesses (2)

CWE-1288

CWE-436

References (8)

http://www.openwall.com/lists/oss-security/2026/05/15/21
https://access.redhat.com/security/cve/CVE-2026-40930
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2484837
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-34287
Advisory
https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4
x_refsource_MISC
https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x
x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-40930
https://www.cve.org/CVERecord?id=CVE-2026-40930

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2026/05/15/21
https://access.redhat.com/security/cve/CVE-2026-40930		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2484837		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-34287		Advisory
https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4		x_refsource_MISC
https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x		x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-40930
https://www.cve.org/CVERecord?id=CVE-2026-40930