A critical out-of-bounds memory vulnerability in the libpng library, specifically within its Neon-optimized palette expansion path, poses a significant risk of arbitrary code execution or system instability.

This vulnerability involves an out-of-bounds read and write flaw triggered when processing PNG images on ARM or AArch64 architectures with Neon optimizations enabled. An unauthenticated attacker can trigger this condition by providing a specially crafted image file, causing the library to dereference pointers outside the allocated buffer during row expansion.

The exploitation of this vulnerability can result in application crashes, denial of service, or potentially arbitrary code execution in the context of the software utilizing the library. Given the widespread use of libpng in image processing pipelines, web browsers, and document readers, the potential for widespread service disruption is high. The CVSS score of 7.6 reflects the serious nature of memory corruption flaws that can be triggered remotely by processing user-supplied content.

Immediate Action: Update the libpng library to version 1.6.56 or later across all affected environments, including container images and build dependencies.

Proactive Monitoring: Monitor system logs for repeated application crashes or segmentation faults occurring during image processing tasks, which may indicate attempted exploitation.

Compensating Controls: Ensure that systems processing untrusted images are running in a sandboxed or restricted environment to limit the impact of a potential compromise.

Public Exploit Available: No (exploit_available: false)

Organizations should prioritize the update of libpng to version 1.6.56 immediately, as this library is a foundational component for many systems. Failure to patch may expose critical infrastructure and end-user applications to memory corruption attacks that are difficult to detect without robust runtime protections.