{
  "threat_severity" : "Moderate",
  "public_date" : "2026-03-26T16:51:58Z",
  "bugzilla" : {
    "description" : "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion",
    "id" : "2451819",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.6",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-124",
  "details" : [ "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without verifying that enough input pixels remain. Because the implementation works backward from the end of the row, the final iteration dereferences pointers before the start of the row buffer (OOB read) and writes expanded pixel data to the same underflowed positions (OOB write). This is reachable via normal decoding of attacker-controlled PNG input if Neon is enabled. Version 1.6.56 fixes the issue.", "A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service." ],
  "affected_release" : [ {
    "product_name" : "OPENJDK ELS 11.0.31",
    "release_date" : "2026-04-22T00:00:00Z",
    "advisory" : "RHSA-2026:9255",
    "cpe" : "cpe:/a:redhat:openjdk_els:11",
    "package" : "java-11-openjdk-portable"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-05-07T00:00:00Z",
    "advisory" : "RHSA-2026:14790",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.1",
    "package" : "libpng-2:1.6.40-8.el10_1.3"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-04-13T00:00:00Z",
    "advisory" : "RHSA-2026:7672",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.1",
    "package" : "firefox-0:140.9.1-1.el10_1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-04-22T00:00:00Z",
    "advisory" : "RHSA-2026:9638",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.1",
    "package" : "thunderbird-0:140.9.1-1.el10_1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-04-22T00:00:00Z",
    "advisory" : "RHSA-2026:9693",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.1",
    "package" : "java-25-openjdk-1:25.0.3.0.9-1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-04-29T00:00:00Z",
    "advisory" : "RHSA-2026:11813",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "thunderbird-0:140.9.1-1.el10_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-05-05T00:00:00Z",
    "advisory" : "RHSA-2026:13665",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "firefox-0:140.9.1-1.el10_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-05-14T00:00:00Z",
    "advisory" : "RHSA-2026:17567",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "libpng-2:1.6.40-8.el10_0.3"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
    "release_date" : "2026-05-06T00:00:00Z",
    "advisory" : "RHSA-2026:13977",
    "cpe" : "cpe:/o:redhat:rhel_els:7",
    "package" : "firefox-0:140.9.1-2.el7_9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-04-14T00:00:00Z",
    "advisory" : "RHSA-2026:8052",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "firefox-0:140.9.1-1.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-04-21T00:00:00Z",
    "advisory" : "RHSA-2026:9345",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "thunderbird-0:140.9.1-1.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.2 Advanced Update Support",
    "release_date" : "2026-04-29T00:00:00Z",
    "advisory" : "RHSA-2026:11805",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.2",
    "package" : "firefox-0:140.9.1-1.el8_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2026-05-05T00:00:00Z",
    "advisory" : "RHSA-2026:13600",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.4",
    "package" : "firefox-0:140.9.1-1.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2026-05-06T00:00:00Z",
    "advisory" : "RHSA-2026:14303",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.4",
    "package" : "thunderbird-0:140.9.1-1.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
    "release_date" : "2026-05-05T00:00:00Z",
    "advisory" : "RHSA-2026:13600",
    "cpe" : "cpe:/a:redhat:rhel_eus_long_life:8.4",
    "package" : "firefox-0:140.9.1-1.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
    "release_date" : "2026-05-06T00:00:00Z",
    "advisory" : "RHSA-2026:14303",
    "cpe" : "cpe:/a:redhat:rhel_eus_long_life:8.4",
    "package" : "thunderbird-0:140.9.1-1.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2026-05-05T00:00:00Z",
    "advisory" : "RHSA-2026:13683",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.6",
    "package" : "firefox-0:140.9.1-1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2026-05-11T00:00:00Z",
    "advisory" : "RHSA-2026:15889",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.6",
    "package" : "thunderbird-0:140.9.1-1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
    "release_date" : "2026-05-05T00:00:00Z",
    "advisory" : "RHSA-2026:13683",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.6",
    "package" : "firefox-0:140.9.1-1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
    "release_date" : "2026-05-11T00:00:00Z",
    "advisory" : "RHSA-2026:15889",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.6",
    "package" : "thunderbird-0:140.9.1-1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
    "release_date" : "2026-05-05T00:00:00Z",
    "advisory" : "RHSA-2026:13683",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.6",
    "package" : "firefox-0:140.9.1-1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
    "release_date" : "2026-05-11T00:00:00Z",
    "advisory" : "RHSA-2026:15889",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.6",
    "package" : "thunderbird-0:140.9.1-1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2026-05-05T00:00:00Z",
    "advisory" : "RHSA-2026:13682",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.8",
    "package" : "firefox-0:140.9.1-1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2026-05-06T00:00:00Z",
    "advisory" : "RHSA-2026:14223",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.8",
    "package" : "thunderbird-0:140.9.1-1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2026-05-05T00:00:00Z",
    "advisory" : "RHSA-2026:13682",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.8",
    "package" : "firefox-0:140.9.1-1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2026-05-06T00:00:00Z",
    "advisory" : "RHSA-2026:14223",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.8",
    "package" : "thunderbird-0:140.9.1-1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-05-07T00:00:00Z",
    "advisory" : "RHSA-2026:14791",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "libpng-2:1.6.37-12.el9_7.3"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-04-13T00:00:00Z",
    "advisory" : "RHSA-2026:7671",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "firefox-0:140.9.1-1.el9_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-04-16T00:00:00Z",
    "advisory" : "RHSA-2026:8459",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "thunderbird-0:140.9.1-1.el9_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-04-22T00:00:00Z",
    "advisory" : "RHSA-2026:9693",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "java-25-openjdk-1:25.0.3.0.9-1.el9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-05-07T00:00:00Z",
    "advisory" : "RHSA-2026:14791",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "libpng-2:1.6.37-12.el9_7.3"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2026-04-30T00:00:00Z",
    "advisory" : "RHSA-2026:12264",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0",
    "package" : "thunderbird-0:140.9.1-1.el9_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2026-05-05T00:00:00Z",
    "advisory" : "RHSA-2026:13596",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0",
    "package" : "firefox-0:140.9.1-1.el9_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2026-05-14T00:00:00Z",
    "advisory" : "RHSA-2026:17685",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0",
    "package" : "libpng-2:1.6.37-12.el9_0.3"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-05-04T00:00:00Z",
    "advisory" : "RHSA-2026:13412",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "thunderbird-0:140.9.1-1.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-05-06T00:00:00Z",
    "advisory" : "RHSA-2026:13922",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "firefox-0:140.9.1-1.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-05-14T00:00:00Z",
    "advisory" : "RHSA-2026:17642",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "libpng-2:1.6.37-12.el9_2.3"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2026-05-04T00:00:00Z",
    "advisory" : "RHSA-2026:13533",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "thunderbird-0:140.9.1-1.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2026-05-05T00:00:00Z",
    "advisory" : "RHSA-2026:13582",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "firefox-0:140.9.1-1.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2026-05-14T00:00:00Z",
    "advisory" : "RHSA-2026:17603",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "libpng-2:1.6.37-12.el9_4.3"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-05-04T00:00:00Z",
    "advisory" : "RHSA-2026:13342",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "thunderbird-0:140.9.1-1.el9_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-05-05T00:00:00Z",
    "advisory" : "RHSA-2026:13583",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "firefox-0:140.9.1-1.el9_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-05-14T00:00:00Z",
    "advisory" : "RHSA-2026:17524",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "libpng-2:1.6.37-12.el9_6.3"
  }, {
    "product_name" : "Red Hat OpenJDK 11 els for RHEL 7",
    "release_date" : "2026-04-22T00:00:00Z",
    "advisory" : "RHSA-2026:9254",
    "cpe" : "cpe:/a:redhat:openjdk_els:11::el7",
    "package" : "java-11-openjdk-1:11.0.31.0.11-1.el7_9"
  }, {
    "product_name" : "Red Hat OpenJDK 11 els for RHEL 8",
    "release_date" : "2026-04-22T00:00:00Z",
    "advisory" : "RHSA-2026:9254",
    "cpe" : "cpe:/a:redhat:openjdk_els:11::el8",
    "package" : "java-11-openjdk-1:11.0.31.0.11-1.el8"
  }, {
    "product_name" : "Red Hat OpenJDK 11 els for RHEL 9",
    "release_date" : "2026-04-22T00:00:00Z",
    "advisory" : "RHSA-2026:9254",
    "cpe" : "cpe:/a:redhat:openjdk_els:11::el9",
    "package" : "java-11-openjdk-1:11.0.31.0.11-1.el9"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-04-07T00:00:00Z",
    "advisory" : "RHSA-2026:6732",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "libpng-main-1.6.56-1.hum1"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat build of OpenJDK 11 ELS",
    "fix_state" : "Affected",
    "package_name" : "java-17-openjdk",
    "cpe" : "cpe:/a:redhat:openjdk_els:11"
  }, {
    "product_name" : "Red Hat build of OpenJDK 11 ELS",
    "fix_state" : "Affected",
    "package_name" : "java-21-openjdk",
    "cpe" : "cpe:/a:redhat:openjdk_els:11"
  }, {
    "product_name" : "Red Hat build of OpenJDK 11 ELS",
    "fix_state" : "Affected",
    "package_name" : "java-21-openjdk-vanilla",
    "cpe" : "cpe:/a:redhat:openjdk_els:11"
  }, {
    "product_name" : "Red Hat build of OpenJDK 11 ELS",
    "fix_state" : "Affected",
    "package_name" : "java-25-openjdk-portable",
    "cpe" : "cpe:/a:redhat:openjdk_els:11"
  }, {
    "product_name" : "Red Hat build of OpenJDK 17",
    "fix_state" : "Affected",
    "package_name" : "java-17-openjdk",
    "cpe" : "cpe:/a:redhat:openjdk:17"
  }, {
    "product_name" : "Red Hat build of OpenJDK 17",
    "fix_state" : "Affected",
    "package_name" : "java-17-openjdk-portable",
    "cpe" : "cpe:/a:redhat:openjdk:17"
  }, {
    "product_name" : "Red Hat build of OpenJDK 17",
    "fix_state" : "Affected",
    "package_name" : "java-21-openjdk",
    "cpe" : "cpe:/a:redhat:openjdk:17"
  }, {
    "product_name" : "Red Hat build of OpenJDK 17",
    "fix_state" : "Affected",
    "package_name" : "java-21-openjdk-vanilla",
    "cpe" : "cpe:/a:redhat:openjdk:17"
  }, {
    "product_name" : "Red Hat build of OpenJDK 17",
    "fix_state" : "Affected",
    "package_name" : "java-25-openjdk-portable",
    "cpe" : "cpe:/a:redhat:openjdk:17"
  }, {
    "product_name" : "Red Hat build of OpenJDK 1.8",
    "fix_state" : "Affected",
    "package_name" : "java-17-openjdk",
    "cpe" : "cpe:/a:redhat:openjdk:1.8"
  }, {
    "product_name" : "Red Hat build of OpenJDK 1.8",
    "fix_state" : "Affected",
    "package_name" : "java-1.8.0-openjdk-portable",
    "cpe" : "cpe:/a:redhat:openjdk:1.8"
  }, {
    "product_name" : "Red Hat build of OpenJDK 1.8",
    "fix_state" : "Affected",
    "package_name" : "java-21-openjdk",
    "cpe" : "cpe:/a:redhat:openjdk:1.8"
  }, {
    "product_name" : "Red Hat build of OpenJDK 1.8",
    "fix_state" : "Affected",
    "package_name" : "java-21-openjdk-vanilla",
    "cpe" : "cpe:/a:redhat:openjdk:1.8"
  }, {
    "product_name" : "Red Hat build of OpenJDK 21",
    "fix_state" : "Affected",
    "package_name" : "java-17-openjdk",
    "cpe" : "cpe:/a:redhat:openjdk:21"
  }, {
    "product_name" : "Red Hat build of OpenJDK 21",
    "fix_state" : "Affected",
    "package_name" : "java-21-openjdk",
    "cpe" : "cpe:/a:redhat:openjdk:21"
  }, {
    "product_name" : "Red Hat build of OpenJDK 21",
    "fix_state" : "Affected",
    "package_name" : "java-21-openjdk-portable",
    "cpe" : "cpe:/a:redhat:openjdk:21"
  }, {
    "product_name" : "Red Hat build of OpenJDK 21",
    "fix_state" : "Affected",
    "package_name" : "java-21-openjdk-vanilla",
    "cpe" : "cpe:/a:redhat:openjdk:21"
  }, {
    "product_name" : "Red Hat build of OpenJDK 21",
    "fix_state" : "Affected",
    "package_name" : "java-25-openjdk-portable",
    "cpe" : "cpe:/a:redhat:openjdk:21"
  }, {
    "product_name" : "Red Hat build of OpenJDK 25",
    "fix_state" : "Affected",
    "package_name" : "java-25-openjdk-portable",
    "cpe" : "cpe:/a:redhat:openjdk:25"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "java-21-openjdk",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Will not fix",
    "package_name" : "libpng",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "libpng",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "libpng12",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "java-17-openjdk",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "java-1.8.0-openjdk",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "java-21-openjdk",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "libpng",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "libpng12",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "libpng15",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "mingw-libpng",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "java-17-openjdk",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "java-1.8.0-openjdk",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "java-21-openjdk",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "libpng15",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "rhcos",
    "cpe" : "cpe:/a:redhat:openshift:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-33636\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33636\nhttps://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869\nhttps://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3\nhttps://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2" ],
  "name" : "CVE-2026-33636",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}