Libpng, a widely used reference library for handling PNG images, has a use‑after‑free bug in the functions png_set_PLTE, png_set_tRNS, and png_set_hIST. When an application retrieves a pointer to internal chunk data via png_get_PLTE, png_get_tRNS, or png_get_hIST and later supplies that same pointer to the matching setter, the setter frees its internal buffer before copying data from the now‑dangling pointer. This causes the function to read from memory that has already been reclaimed, producing silently corrupted PNG metadata or leaking unrelated heap contents into the chunk structure.

The flaw affects all libpng releases from 1.0.9 up to, but not including, 1.6.57. Many image viewers, editors, and third‑party tools that integrate libpng are potentially using these versions. Systems should verify the libpng version they deploy and apply an update to 1.6.57 or later.

The base CVSS score of 5.1 indicates medium severity and no EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation. The most likely attack vector involves the processing of a malicious PNG file that triggers the vulnerable setter through a getter‑returned pointer. Based on the description, it is inferred that an attacker must supply a crafted PNG that forces libpng to execute the flawed routine and take advantage of the freed memory read. Successful exploitation would result in the disclosure of heap contents or corruption of image metadata, potentially leading to further attacker‑controlled payload execution in downstream consumers of the PNG data.