CVE-2026-58936

In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free

Risk score: 65/100
CVSS: 9.8 v3.1
Exploit chance (30 days): 0.2%
Published: 2 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is: A critical vulnerability in png_set_tRNS of pngset.c allows for remote code execution with no additional privileges needed, leading to potential memory corruption.
Affected: {'products': [], 'packages': [], 'versions': []}
Fix: Check the linked advisory for details on affected products and versions.
Exploitation: No known exploitation

Why it is Amber

CVSS 9.8 critical
Remotely exploitable without logging in

References

https://source.android.com/docs/security/bulletin/2026/2026-11-01

Original description

In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Last activity 2 Nov 2026. Patch Forecast updates every hour.