The vulnerability in libpng arises from pointer aliasing between png_struct and png_info. The trans_alpha buffer set by png_set_tRNS and the palette buffer set by png_set_PLTE share a single heap allocation. After png_free_data frees the buffer through one struct, the other’s pointer remains dangling. Subsequent processing of PNG data can dereference or write to this freed memory, potentially causing a crash or allowing an attacker to execute arbitrary code, thereby compromising integrity and availability.

The affected product is libpng released by pnggroup. All versions from 1.2.1 through 1.6.55 contain the flaw. Applications that link to these libpng releases and process PNG files with tRNS or PLTE chunks are at risk.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an application to parse a PNG file and later invoke png_set_tRNS or png_set_PLTE, triggering the use‑after‑free during subsequent row‑transform operations. Though the exact attack vector is not specified, an attacker can trigger the flaw by supplying a crafted PNG—potentially via a network connection if the application accepts external image data—leading to arbitrary code execution or denial of service. The risk remains significant where such image processing is performed.