Our engineers have discovered a Use-After-Free vulnerability in libpng (CVE-2026-33416)!

One of our engineers recently discovered a vulnerability in the image processing library libpng, and a security advisory has been published.
The summary of this vulnerability is as follows:

This vulnerability is classified as a “Use-After-Free” vulnerability; processing a specially crafted PNG image could lead to information disclosure or arbitrary code execution.
libpng is a widely used library employed in software around the world, and this vulnerability could affect many systems.

A visual representation of the attack

An attacker can carry out an attack by tricking the victim into uploading a malicious PNG image.

To briefly outline the attack flow, it goes as follows. Steps 3 through 6 correspond to the vulnerabilities discovered in libpng, and the diagram above illustrates how those vulnerabilities work.

　１．The attacker creates a malicious PNG image
　２．The image is uploaded to a website or system
　３．libpng processes the image on the server side
　４．A use-after-free vulnerability occurs
　５．Memory corruption
　６．Information disclosure or arbitrary code execution

In other words, attackers can carry out an attack by tricking users into uploading a malicious PNG image, and features that allow users to upload images, such as the one described below, serve as an entry point for the attack.

　・Uploading profile pictures
　・Attaching images to contact forms
　・Generating thumbnails
　・Sending images in chat
　・Attaching images to emails
　・AI image generation and analysis
　・Surveillance camera image processing
　・Medical imaging systems

From Vulnerability Discovery to Disclosure

Our engineers,

　１．Discovery of vulnerabilities
　２．Creation of Proof of Concept (PoC) code
　３．Verification of attack feasibility

We carried out the necessary steps and reported the details of this vulnerability to the libpng maintainers.
Subsequently, a fix was developed in collaboration with the maintainers and developers, and the vulnerability was disclosed.

Our company conducts research and development in the following technical fields, and this vulnerability was discovered during these R&D activities.

　・Efficient investigation and discovery of zero-day vulnerabilities
　・Automation of penetration testing
　・Security measures for the OT/IoT sector
　・Investigation and research into advanced attack techniques that evade EDR and similar solutions
　・Security measures leveraging large language models (LLMs)

About MUSHIKAGO and Our Initiatives

Our product, “MUSHIKAGO,” enables advanced security validation centered on automated penetration testing.
Our engineers, who possess the technical expertise to identify vulnerabilities, and our sales team, who sincerely address customer feedback and requests, work together as one to continue providing products and services that stay ahead of evolving cyberattacks and proactively implement countermeasures.

Reference

1. https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j
2. https://www.cve.org/CVERecord?id=CVE-2026-33416
3. https://nvd.nist.gov/vuln/detail/CVE-2026-33416
4. https://gbhackers.com/png-vulnerabilities-leak-sensitive-data/