A critical use after free vulnerability in the libpng library, fixed in version 1.6.56, poses a high risk of memory corruption and potential code execution when processing malicious PNG files.

This vulnerability involves a use after free condition within the png_set_tRNS and png_set_PLTE functions. Improper buffer aliasing between png_struct and png_info leads to dangling pointers, which can be triggered by an unauthenticated attacker providing a specifically crafted PNG image.

Successful exploitation of this flaw can lead to memory corruption, which may allow an attacker to achieve remote code execution or cause application crashes. Given the ubiquity of libpng across countless desktop and server applications, this vulnerability presents a significant risk to data integrity and system availability. The CVSS score of 7.5 reflects the high potential for impact, necessitating immediate attention in environments where untrusted image processing occurs.

Immediate Action: Upgrade all instances of the libpng library to version 1.6.56 or later to incorporate the required memory management fixes.

Proactive Monitoring: Monitor application logs for unexpected crashes or segmentation faults during image processing tasks, which may indicate attempted exploitation.

Compensating Controls: Use application sandboxing or memory-safe wrappers for image processing components to limit the impact of potential memory corruption if immediate patching is not feasible.

Public Exploit Available: No

Organizations relying on libpng for image processing must prioritize updating to version 1.6.56 immediately. Given that this library is a foundational component for many graphical applications and web services, verifying the version in use across the infrastructure is essential to mitigating this high severity risk.