The vulnerability lies in libpng’s ARM/AArch64 NEON-optimized palette expansion routine. When converting 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without checking that enough input pixels remain. Because the routine works backwards from the end of the row, the loop dereferences pointers before the start of the row buffer, causing an out-of-bounds read, and subsequently writes expanded pixel data to the same underflowed positions, leading to an out-of-bounds write. This memory corruption can allow an attacker to read sensitive data from the process address space or trigger a crash, depending on the context. The weakness is represented by CWE-124, CWE-125, and CWE-787.

The affected product is pnggroup’s libpng reference library. Versions 1.6.36 through 1.6.55 on ARM AArch64 platforms with NEON enabled are vulnerable. Applications that use an affected libpng build—such as image viewers, web servers, or other software that decodes PNG data—are at risk. The issue is fixed in libpng 1.6.56 and later.

The CVSS v3 score of 7.6 indicates high severity, while the EPSS score of under 1% suggests that exploitation is unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation. An attacker can trigger the flaw by feeding a crafted PNG file to any application that decodes images using the vulnerable libpng and has NEON enabled. Unlike many image-based bugs that only allow crashes, this out-of-bounds read/write can also provide access to process memory, potentially leading to information disclosure or further exploitation. However, the attack requires ARM AArch64 hardware and the NEON optimization path, which limits the attack surface to devices that meet these hardware and configuration conditions.