{"id":"ASB-A-496614216", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-02T16:38:00.081625681Z", "aliases":["CVE-2026-58936", "A-496614216"], "details":"In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/external/libpng", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-qpr2-next:0"}, {"fixed":"17-qpr2-next:2026-11-01"}]}], "versions":["17-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libpng/+/a79a49c7e50f403030d66f5fbf6ce6099786d217", "https://android.googlesource.com/platform/external/libpng/+/735832705bce6de8ea2f60d2f9b8c125827c613a", "https://android.googlesource.com/platform/external/libpng/+/58036313bc3a59a9c93d50809bde80d641c7c988", "https://android.googlesource.com/platform/external/libpng/+/dc2c38735fbdc46de64efa5036bea7257ca3faec"], "severity":"Critical", "spl":"2026-11-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["43864688537629825574037726808235944326", "170818353614958581891937302016861126841", "278154899009160441335130137202641445200"], "threshold":0.9}, "id":"ASB-A-496614216-103fd9ab", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/58036313bc3a59a9c93d50809bde80d641c7c988", "target":{"file":"pngwrite.c"}}, {"deprecated":false, "digest":{"line_hashes":["295188705198664353711129016364915234481", "61186881870620331963563260190091368059", "85813034465098086945703998494715198010", "36639532824671943475506617781821801755"], "threshold":0.9}, "id":"ASB-A-496614216-2ffef1f1", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/58036313bc3a59a9c93d50809bde80d641c7c988", "target":{"file":"pngrtran.c"}}, {"deprecated":false, "digest":{"line_hashes":["23623163812270411804043276495619393360", "249237697521696422883177204471113927941", "98349001497949537832314024201702512510", "78918956699117434114211950372061766681", "237207366743186671084450212310891543569", "216031739450190108770194427049918952681", "196390267377363788697953867336844267126", "48686845457453161111412298511702194846", "253260827306397238091500280458617225372", "34643465992538610679045217732203960938", "318817520864536858434095433116773382862"], "threshold":0.9}, "id":"ASB-A-496614216-3df08656", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/58036313bc3a59a9c93d50809bde80d641c7c988", "target":{"file":"pngset.c"}}, {"deprecated":false, "digest":{"line_hashes":["98250150014725793241419848892413636482", "178195276882115633313296615493177798347", "25821686872119194689388687505844949308", "227026791080689077429011535169474272442", "330282194084099661137173723318868244171", "107706244600529939118018940606878508341", "178700209567818827418407780831917929359", "287471555282919382848424250461084643241", "209745718595423869275787055612001785623", "2193192155644361006466675754143514414", "141909920218320054918118988767399339265", "26768757656783073233094152591480478634", "40812701347163550374053105626947511165"], "threshold":0.9}, "id":"ASB-A-496614216-4876f387", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/a79a49c7e50f403030d66f5fbf6ce6099786d217", "target":{"file":"pngset.c"}}, {"deprecated":false, "digest":{"line_hashes":["132271531588699432055803361145099610809", "65959435425179038609954885545663919930", "309074223655768629569164703220595436025", "322267439836006670487936700399879236401", "12150830541721880045790454698624805187", "317024228464654619763612828428494868402", "191979943930225737051145180056805495095", "169730874509956863687399430614975043623", "211794578928073518449791588814755226723"], "threshold":0.9}, "id":"ASB-A-496614216-4d227f2c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/a79a49c7e50f403030d66f5fbf6ce6099786d217", "target":{"file":"pngread.c"}}, {"deprecated":false, "digest":{"function_hash":"311015491646152627470899922889670583497", "length":771}, "id":"ASB-A-496614216-50f9512b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/58036313bc3a59a9c93d50809bde80d641c7c988", "target":{"file":"pngwrite.c", "function":"png_write_destroy"}}, {"deprecated":false, "digest":{"function_hash":"261304792064467024282742116954189039042", "length":4192}, "id":"ASB-A-496614216-5a3c0ca3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/dc2c38735fbdc46de64efa5036bea7257ca3faec", "target":{"file":"pngrtran.c", "function":"png_read_transform_info"}}, {"deprecated":false, "digest":{"line_hashes":["78664929825541045347943804030659098153", "275886753624758850400559950953109869061", "278154899009160441335130137202641445200"], "threshold":0.9}, "id":"ASB-A-496614216-67de5804", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/a79a49c7e50f403030d66f5fbf6ce6099786d217", "target":{"file":"pngwrite.c"}}, {"deprecated":false, "digest":{"function_hash":"304635397398783513978631995226858131043", "length":1390}, "id":"ASB-A-496614216-767d7109", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/735832705bce6de8ea2f60d2f9b8c125827c613a", "target":{"file":"pngset.c", "function":"png_set_tRNS"}}, {"deprecated":false, "digest":{"function_hash":"181809372360778135365659772572571466078", "length":1154}, "id":"ASB-A-496614216-859de1d6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/58036313bc3a59a9c93d50809bde80d641c7c988", "target":{"file":"pngset.c", "function":"png_set_PLTE"}}, {"deprecated":false, "digest":{"function_hash":"173692133047662245734139657595136211741", "length":1171}, "id":"ASB-A-496614216-8648d1e2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/a79a49c7e50f403030d66f5fbf6ce6099786d217", "target":{"file":"pngset.c", "function":"png_set_tRNS"}}, {"deprecated":false, "digest":{"function_hash":"95039209216747699324711564486998941776", "length":1578}, "id":"ASB-A-496614216-a6a1e715", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/58036313bc3a59a9c93d50809bde80d641c7c988", "target":{"file":"pngread.c", "function":"png_read_destroy"}}, {"deprecated":false, "digest":{"function_hash":"6181938991129466879817268636515152608", "length":1692}, "id":"ASB-A-496614216-b87bf2df", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/a79a49c7e50f403030d66f5fbf6ce6099786d217", "target":{"file":"pngread.c", "function":"png_read_destroy"}}, {"deprecated":false, "digest":{"function_hash":"50561903265488059777009644901888514277", "length":6171}, "id":"ASB-A-496614216-bdb81a68", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/58036313bc3a59a9c93d50809bde80d641c7c988", "target":{"file":"pngrtran.c", "function":"png_set_quantize"}}, {"deprecated":false, "digest":{"line_hashes":["3440380680870728141840740884913181935", "194675352698992964869628188225393571793", "286290118669996794184809476503204994858"], "threshold":0.9}, "id":"ASB-A-496614216-be282e75", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/dc2c38735fbdc46de64efa5036bea7257ca3faec", "target":{"file":"pngrtran.c"}}, {"deprecated":false, "digest":{"line_hashes":["227026791080689077429011535169474272442", "330282194084099661137173723318868244171", "107706244600529939118018940606878508341", "178700209567818827418407780831917929359", "287471555282919382848424250461084643241", "25059713478850395472297232412415619623", "158404001942170724082453012292215288017", "273120231683896222383495422854080657245", "264161995622523342792879822668003940787"], "threshold":0.9}, "id":"ASB-A-496614216-c430debd", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/735832705bce6de8ea2f60d2f9b8c125827c613a", "target":{"file":"pngset.c"}}, {"deprecated":false, "digest":{"line_hashes":["117014855185263494942688330135686104575", "325752230950023682901889462812000934508", "54327872665649901308013752597204569586", "162546633693826527505656352290049025683", "276425541579252735905723904052126907315", "60710387181426351393555820526981427402", "206950420709034598758692366423367440074", "245759719882350592384312250931872612852", "162728383063999463456796575335251655957"], "threshold":0.9}, "id":"ASB-A-496614216-db7264fc", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/58036313bc3a59a9c93d50809bde80d641c7c988", "target":{"file":"pngread.c"}}, {"deprecated":false, "digest":{"function_hash":"236483884268181938566890713142960837813", "length":656}, "id":"ASB-A-496614216-f8155a20", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/a79a49c7e50f403030d66f5fbf6ce6099786d217", "target":{"file":"pngwrite.c", "function":"png_write_destroy"}}]}}, {"package":{"name":"platform/external/libpng", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-11-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libpng/+/def2d9c7e0b8938d197c698921f0c16fb9eec739", "https://android.googlesource.com/platform/external/libpng/+/d5220a78f2ab35f65fffaf7424a0af553f18d6bb", "https://android.googlesource.com/platform/external/libpng/+/8869ba72b705c5b1953eae581958a43ee1912670", "https://android.googlesource.com/platform/external/libpng/+/55998afc7a540b0909dfc0ffc749ae4343278e2a"], "severity":"Critical", "spl":"2026-11-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"50561903265488059777009644901888514277", "length":6171}, "id":"ASB-A-496614216-0f502f13", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/8869ba72b705c5b1953eae581958a43ee1912670", "target":{"file":"pngrtran.c", "function":"png_set_quantize"}}, {"deprecated":false, "digest":{"function_hash":"311015491646152627470899922889670583497", "length":771}, "id":"ASB-A-496614216-228fe404", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/8869ba72b705c5b1953eae581958a43ee1912670", "target":{"file":"pngwrite.c", "function":"png_write_destroy"}}, {"deprecated":false, "digest":{"function_hash":"181809372360778135365659772572571466078", "length":1154}, "id":"ASB-A-496614216-2c5b22e5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/8869ba72b705c5b1953eae581958a43ee1912670", "target":{"file":"pngset.c", "function":"png_set_PLTE"}}, {"deprecated":false, "digest":{"function_hash":"313132398624434139521442748785736498765", "length":1622}, "id":"ASB-A-496614216-36d532f5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/def2d9c7e0b8938d197c698921f0c16fb9eec739", "target":{"file":"pngread.c", "function":"png_read_destroy"}}, {"deprecated":false, "digest":{"line_hashes":["23623163812270411804043276495619393360", "249237697521696422883177204471113927941", "98349001497949537832314024201702512510", "78918956699117434114211950372061766681", "237207366743186671084450212310891543569", "216031739450190108770194427049918952681", "196390267377363788697953867336844267126", "48686845457453161111412298511702194846", "253260827306397238091500280458617225372", "34643465992538610679045217732203960938", "318817520864536858434095433116773382862"], "threshold":0.9}, "id":"ASB-A-496614216-3c13b528", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/8869ba72b705c5b1953eae581958a43ee1912670", "target":{"file":"pngset.c"}}, {"deprecated":false, "digest":{"function_hash":"173692133047662245734139657595136211741", "length":1171}, "id":"ASB-A-496614216-3eb9bfe0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/def2d9c7e0b8938d197c698921f0c16fb9eec739", "target":{"file":"pngset.c", "function":"png_set_tRNS"}}, {"deprecated":false, "digest":{"line_hashes":["98250150014725793241419848892413636482", "178195276882115633313296615493177798347", "25821686872119194689388687505844949308", "227026791080689077429011535169474272442", "330282194084099661137173723318868244171", "107706244600529939118018940606878508341", "178700209567818827418407780831917929359", "287471555282919382848424250461084643241", "209745718595423869275787055612001785623", "2193192155644361006466675754143514414", "141909920218320054918118988767399339265", "26768757656783073233094152591480478634", "40812701347163550374053105626947511165"], "threshold":0.9}, "id":"ASB-A-496614216-4e52077c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/def2d9c7e0b8938d197c698921f0c16fb9eec739", "target":{"file":"pngset.c"}}, {"deprecated":false, "digest":{"function_hash":"236483884268181938566890713142960837813", "length":656}, "id":"ASB-A-496614216-61961d6f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/def2d9c7e0b8938d197c698921f0c16fb9eec739", "target":{"file":"pngwrite.c", "function":"png_write_destroy"}}, {"deprecated":false, "digest":{"line_hashes":["43864688537629825574037726808235944326", "170818353614958581891937302016861126841", "278154899009160441335130137202641445200"], "threshold":0.9}, "id":"ASB-A-496614216-9131d02b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/8869ba72b705c5b1953eae581958a43ee1912670", "target":{"file":"pngwrite.c"}}, {"deprecated":false, "digest":{"line_hashes":["117014855185263494942688330135686104575", "325752230950023682901889462812000934508", "54327872665649901308013752597204569586", "162546633693826527505656352290049025683", "276425541579252735905723904052126907315", "60710387181426351393555820526981427402", "206950420709034598758692366423367440074", "245759719882350592384312250931872612852", "162728383063999463456796575335251655957"], "threshold":0.9}, "id":"ASB-A-496614216-954d1fb5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/8869ba72b705c5b1953eae581958a43ee1912670", "target":{"file":"pngread.c"}}, {"deprecated":false, "digest":{"function_hash":"160601585003269099030650680031230944203", "length":4213}, "id":"ASB-A-496614216-9b9b9b7c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/55998afc7a540b0909dfc0ffc749ae4343278e2a", "target":{"file":"pngrtran.c", "function":"png_read_transform_info"}}, {"deprecated":false, "digest":{"line_hashes":["132271531588699432055803361145099610809", "65959435425179038609954885545663919930", "309074223655768629569164703220595436025", "322267439836006670487936700399879236401", "12150830541721880045790454698624805187", "317024228464654619763612828428494868402", "191979943930225737051145180056805495095", "169730874509956863687399430614975043623", "211794578928073518449791588814755226723"], "threshold":0.9}, "id":"ASB-A-496614216-b157682b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/def2d9c7e0b8938d197c698921f0c16fb9eec739", "target":{"file":"pngread.c"}}, {"deprecated":false, "digest":{"line_hashes":["295188705198664353711129016364915234481", "61186881870620331963563260190091368059", "85813034465098086945703998494715198010", "36639532824671943475506617781821801755"], "threshold":0.9}, "id":"ASB-A-496614216-bf072c7e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/8869ba72b705c5b1953eae581958a43ee1912670", "target":{"file":"pngrtran.c"}}, {"deprecated":false, "digest":{"function_hash":"213957024040271508681494972943491585358", "length":1508}, "id":"ASB-A-496614216-e3448f54", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/8869ba72b705c5b1953eae581958a43ee1912670", "target":{"file":"pngread.c", "function":"png_read_destroy"}}, {"deprecated":false, "digest":{"function_hash":"304635397398783513978631995226858131043", "length":1390}, "id":"ASB-A-496614216-edd12649", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/d5220a78f2ab35f65fffaf7424a0af553f18d6bb", "target":{"file":"pngset.c", "function":"png_set_tRNS"}}, {"deprecated":false, "digest":{"line_hashes":["3440380680870728141840740884913181935", "194675352698992964869628188225393571793", "286290118669996794184809476503204994858"], "threshold":0.9}, "id":"ASB-A-496614216-ef49c341", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/55998afc7a540b0909dfc0ffc749ae4343278e2a", "target":{"file":"pngrtran.c"}}, {"deprecated":false, "digest":{"line_hashes":["227026791080689077429011535169474272442", "330282194084099661137173723318868244171", "107706244600529939118018940606878508341", "178700209567818827418407780831917929359", "287471555282919382848424250461084643241", "25059713478850395472297232412415619623", "158404001942170724082453012292215288017", "273120231683896222383495422854080657245", "264161995622523342792879822668003940787"], "threshold":0.9}, "id":"ASB-A-496614216-f9a4684b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/d5220a78f2ab35f65fffaf7424a0af553f18d6bb", "target":{"file":"pngset.c"}}, {"deprecated":false, "digest":{"line_hashes":["78664929825541045347943804030659098153", "275886753624758850400559950953109869061", "278154899009160441335130137202641445200"], "threshold":0.9}, "id":"ASB-A-496614216-fb156b89", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/def2d9c7e0b8938d197c698921f0c16fb9eec739", "target":{"file":"pngwrite.c"}}]}}, {"package":{"name":"platform/external/libpng", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-11-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libpng/+/d4ecf0604372e2847b159b39a981a98f357d266f", "https://android.googlesource.com/platform/external/libpng/+/45861e131600ee2eaa391577a9ade9826dbed388", "https://android.googlesource.com/platform/external/libpng/+/3c9742a5db095ed135455412bae146a74e0d9a31", "https://android.googlesource.com/platform/external/libpng/+/1d347ce0a8f4d57e1008877220a6c8b283d651a1"], "severity":"Critical", "spl":"2026-11-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["23623163812270411804043276495619393360", "249237697521696422883177204471113927941", "98349001497949537832314024201702512510", "78918956699117434114211950372061766681", "237207366743186671084450212310891543569", "216031739450190108770194427049918952681", "196390267377363788697953867336844267126", "48686845457453161111412298511702194846", "253260827306397238091500280458617225372", "34643465992538610679045217732203960938", "318817520864536858434095433116773382862"], "threshold":0.9}, "id":"ASB-A-496614216-01c53948", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/3c9742a5db095ed135455412bae146a74e0d9a31", "target":{"file":"pngset.c"}}, {"deprecated":false, "digest":{"line_hashes":["117014855185263494942688330135686104575", "325752230950023682901889462812000934508", "54327872665649901308013752597204569586", "162546633693826527505656352290049025683", "276425541579252735905723904052126907315", "60710387181426351393555820526981427402", "206950420709034598758692366423367440074", "245759719882350592384312250931872612852", "162728383063999463456796575335251655957"], "threshold":0.9}, "id":"ASB-A-496614216-1009d9b3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/3c9742a5db095ed135455412bae146a74e0d9a31", "target":{"file":"pngread.c"}}, {"deprecated":false, "digest":{"function_hash":"173692133047662245734139657595136211741", "length":1171}, "id":"ASB-A-496614216-2522998c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/d4ecf0604372e2847b159b39a981a98f357d266f", "target":{"file":"pngset.c", "function":"png_set_tRNS"}}, {"deprecated":false, "digest":{"line_hashes":["132271531588699432055803361145099610809", "65959435425179038609954885545663919930", "309074223655768629569164703220595436025", "322267439836006670487936700399879236401", "12150830541721880045790454698624805187", "317024228464654619763612828428494868402", "191979943930225737051145180056805495095", "169730874509956863687399430614975043623", "211794578928073518449791588814755226723"], "threshold":0.9}, "id":"ASB-A-496614216-3530865b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/d4ecf0604372e2847b159b39a981a98f357d266f", "target":{"file":"pngread.c"}}, {"deprecated":false, "digest":{"function_hash":"313132398624434139521442748785736498765", "length":1622}, "id":"ASB-A-496614216-4485d5db", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/d4ecf0604372e2847b159b39a981a98f357d266f", "target":{"file":"pngread.c", "function":"png_read_destroy"}}, {"deprecated":false, "digest":{"function_hash":"236483884268181938566890713142960837813", "length":656}, "id":"ASB-A-496614216-59e52f2a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/d4ecf0604372e2847b159b39a981a98f357d266f", "target":{"file":"pngwrite.c", "function":"png_write_destroy"}}, {"deprecated":false, "digest":{"line_hashes":["43864688537629825574037726808235944326", "170818353614958581891937302016861126841", "278154899009160441335130137202641445200"], "threshold":0.9}, "id":"ASB-A-496614216-5cb8a9eb", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/3c9742a5db095ed135455412bae146a74e0d9a31", "target":{"file":"pngwrite.c"}}, {"deprecated":false, "digest":{"line_hashes":["98250150014725793241419848892413636482", "178195276882115633313296615493177798347", "25821686872119194689388687505844949308", "227026791080689077429011535169474272442", "330282194084099661137173723318868244171", "107706244600529939118018940606878508341", "178700209567818827418407780831917929359", "287471555282919382848424250461084643241", "209745718595423869275787055612001785623", "2193192155644361006466675754143514414", "141909920218320054918118988767399339265", "26768757656783073233094152591480478634", "40812701347163550374053105626947511165"], "threshold":0.9}, "id":"ASB-A-496614216-7298fb23", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/d4ecf0604372e2847b159b39a981a98f357d266f", "target":{"file":"pngset.c"}}, {"deprecated":false, "digest":{"function_hash":"181809372360778135365659772572571466078", "length":1154}, "id":"ASB-A-496614216-96082922", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/3c9742a5db095ed135455412bae146a74e0d9a31", "target":{"file":"pngset.c", "function":"png_set_PLTE"}}, {"deprecated":false, "digest":{"line_hashes":["295188705198664353711129016364915234481", "61186881870620331963563260190091368059", "85813034465098086945703998494715198010", "36639532824671943475506617781821801755"], "threshold":0.9}, "id":"ASB-A-496614216-9a4f0983", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/3c9742a5db095ed135455412bae146a74e0d9a31", "target":{"file":"pngrtran.c"}}, {"deprecated":false, "digest":{"line_hashes":["227026791080689077429011535169474272442", "330282194084099661137173723318868244171", "107706244600529939118018940606878508341", "178700209567818827418407780831917929359", "287471555282919382848424250461084643241", "25059713478850395472297232412415619623", "158404001942170724082453012292215288017", "273120231683896222383495422854080657245", "264161995622523342792879822668003940787"], "threshold":0.9}, "id":"ASB-A-496614216-a695107e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/45861e131600ee2eaa391577a9ade9826dbed388", "target":{"file":"pngset.c"}}, {"deprecated":false, "digest":{"function_hash":"213957024040271508681494972943491585358", "length":1508}, "id":"ASB-A-496614216-ac500930", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/3c9742a5db095ed135455412bae146a74e0d9a31", "target":{"file":"pngread.c", "function":"png_read_destroy"}}, {"deprecated":false, "digest":{"function_hash":"160601585003269099030650680031230944203", "length":4213}, "id":"ASB-A-496614216-aec345aa", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/1d347ce0a8f4d57e1008877220a6c8b283d651a1", "target":{"file":"pngrtran.c", "function":"png_read_transform_info"}}, {"deprecated":false, "digest":{"function_hash":"304635397398783513978631995226858131043", "length":1390}, "id":"ASB-A-496614216-b17dc2fe", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/45861e131600ee2eaa391577a9ade9826dbed388", "target":{"file":"pngset.c", "function":"png_set_tRNS"}}, {"deprecated":false, "digest":{"line_hashes":["78664929825541045347943804030659098153", "275886753624758850400559950953109869061", "278154899009160441335130137202641445200"], "threshold":0.9}, "id":"ASB-A-496614216-bc7adc3d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/d4ecf0604372e2847b159b39a981a98f357d266f", "target":{"file":"pngwrite.c"}}, {"deprecated":false, "digest":{"line_hashes":["3440380680870728141840740884913181935", "194675352698992964869628188225393571793", "286290118669996794184809476503204994858"], "threshold":0.9}, "id":"ASB-A-496614216-bd2f64b3", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/1d347ce0a8f4d57e1008877220a6c8b283d651a1", "target":{"file":"pngrtran.c"}}, {"deprecated":false, "digest":{"function_hash":"311015491646152627470899922889670583497", "length":771}, "id":"ASB-A-496614216-c23f88e0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/3c9742a5db095ed135455412bae146a74e0d9a31", "target":{"file":"pngwrite.c", "function":"png_write_destroy"}}, {"deprecated":false, "digest":{"function_hash":"50561903265488059777009644901888514277", "length":6171}, "id":"ASB-A-496614216-e1d72f84", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/3c9742a5db095ed135455412bae146a74e0d9a31", "target":{"file":"pngrtran.c", "function":"png_set_quantize"}}]}}, {"package":{"name":"platform/external/libpng", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-11-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libpng/+/fc1db92407a123bab74c70e4ee916b19dd36a8bb", "https://android.googlesource.com/platform/external/libpng/+/6c02bc240cfbb99e43a72de79cbbaabbee466035", "https://android.googlesource.com/platform/external/libpng/+/31264a30a551ac19aaaec79ff875f483b0f7724a", "https://android.googlesource.com/platform/external/libpng/+/0b1ac71af18303ed4b89255f1db7c45a70351e15"], "severity":"Critical", "spl":"2026-11-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"304635397398783513978631995226858131043", "length":1390}, "id":"ASB-A-496614216-0006828a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/6c02bc240cfbb99e43a72de79cbbaabbee466035", "target":{"file":"pngset.c", "function":"png_set_tRNS"}}, {"deprecated":false, "digest":{"function_hash":"236483884268181938566890713142960837813", "length":656}, "id":"ASB-A-496614216-03ef998e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/fc1db92407a123bab74c70e4ee916b19dd36a8bb", "target":{"file":"pngwrite.c", "function":"png_write_destroy"}}, {"deprecated":false, "digest":{"line_hashes":["23623163812270411804043276495619393360", "249237697521696422883177204471113927941", "98349001497949537832314024201702512510", "78918956699117434114211950372061766681", "237207366743186671084450212310891543569", "216031739450190108770194427049918952681", "196390267377363788697953867336844267126", "48686845457453161111412298511702194846", "253260827306397238091500280458617225372", "34643465992538610679045217732203960938", "318817520864536858434095433116773382862"], "threshold":0.9}, "id":"ASB-A-496614216-0db38a50", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/31264a30a551ac19aaaec79ff875f483b0f7724a", "target":{"file":"pngset.c"}}, {"deprecated":false, "digest":{"function_hash":"173692133047662245734139657595136211741", "length":1171}, "id":"ASB-A-496614216-22665b70", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/fc1db92407a123bab74c70e4ee916b19dd36a8bb", "target":{"file":"pngset.c", "function":"png_set_tRNS"}}, {"deprecated":false, "digest":{"function_hash":"311015491646152627470899922889670583497", "length":771}, "id":"ASB-A-496614216-39be391d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/31264a30a551ac19aaaec79ff875f483b0f7724a", "target":{"file":"pngwrite.c", "function":"png_write_destroy"}}, {"deprecated":false, "digest":{"line_hashes":["78664929825541045347943804030659098153", "275886753624758850400559950953109869061", "278154899009160441335130137202641445200"], "threshold":0.9}, "id":"ASB-A-496614216-4137d3d5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/fc1db92407a123bab74c70e4ee916b19dd36a8bb", "target":{"file":"pngwrite.c"}}, {"deprecated":false, "digest":{"line_hashes":["98250150014725793241419848892413636482", "178195276882115633313296615493177798347", "25821686872119194689388687505844949308", "227026791080689077429011535169474272442", "330282194084099661137173723318868244171", "107706244600529939118018940606878508341", "178700209567818827418407780831917929359", "287471555282919382848424250461084643241", "209745718595423869275787055612001785623", "2193192155644361006466675754143514414", "141909920218320054918118988767399339265", "26768757656783073233094152591480478634", "40812701347163550374053105626947511165"], "threshold":0.9}, "id":"ASB-A-496614216-42709da6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/fc1db92407a123bab74c70e4ee916b19dd36a8bb", "target":{"file":"pngset.c"}}, {"deprecated":false, "digest":{"line_hashes":["3440380680870728141840740884913181935", "194675352698992964869628188225393571793", "286290118669996794184809476503204994858"], "threshold":0.9}, "id":"ASB-A-496614216-44a71ce2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/0b1ac71af18303ed4b89255f1db7c45a70351e15", "target":{"file":"pngrtran.c"}}, {"deprecated":false, "digest":{"line_hashes":["295188705198664353711129016364915234481", "61186881870620331963563260190091368059", "85813034465098086945703998494715198010", "36639532824671943475506617781821801755"], "threshold":0.9}, "id":"ASB-A-496614216-6abe1c4c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/31264a30a551ac19aaaec79ff875f483b0f7724a", "target":{"file":"pngrtran.c"}}, {"deprecated":false, "digest":{"function_hash":"50561903265488059777009644901888514277", "length":6171}, "id":"ASB-A-496614216-7a40d983", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/31264a30a551ac19aaaec79ff875f483b0f7724a", "target":{"file":"pngrtran.c", "function":"png_set_quantize"}}, {"deprecated":false, "digest":{"line_hashes":["132271531588699432055803361145099610809", "65959435425179038609954885545663919930", "309074223655768629569164703220595436025", "322267439836006670487936700399879236401", "12150830541721880045790454698624805187", "317024228464654619763612828428494868402", "191979943930225737051145180056805495095", "169730874509956863687399430614975043623", "211794578928073518449791588814755226723"], "threshold":0.9}, "id":"ASB-A-496614216-86849084", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/fc1db92407a123bab74c70e4ee916b19dd36a8bb", "target":{"file":"pngread.c"}}, {"deprecated":false, "digest":{"line_hashes":["227026791080689077429011535169474272442", "330282194084099661137173723318868244171", "107706244600529939118018940606878508341", "178700209567818827418407780831917929359", "287471555282919382848424250461084643241", "25059713478850395472297232412415619623", "158404001942170724082453012292215288017", "273120231683896222383495422854080657245", "264161995622523342792879822668003940787"], "threshold":0.9}, "id":"ASB-A-496614216-8ea380b0", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/6c02bc240cfbb99e43a72de79cbbaabbee466035", "target":{"file":"pngset.c"}}, {"deprecated":false, "digest":{"function_hash":"313132398624434139521442748785736498765", "length":1622}, "id":"ASB-A-496614216-94cb3e0c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/fc1db92407a123bab74c70e4ee916b19dd36a8bb", "target":{"file":"pngread.c", "function":"png_read_destroy"}}, {"deprecated":false, "digest":{"line_hashes":["117014855185263494942688330135686104575", "325752230950023682901889462812000934508", "54327872665649901308013752597204569586", "162546633693826527505656352290049025683", "276425541579252735905723904052126907315", "60710387181426351393555820526981427402", "206950420709034598758692366423367440074", "245759719882350592384312250931872612852", "162728383063999463456796575335251655957"], "threshold":0.9}, "id":"ASB-A-496614216-b34b0900", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/31264a30a551ac19aaaec79ff875f483b0f7724a", "target":{"file":"pngread.c"}}, {"deprecated":false, "digest":{"line_hashes":["43864688537629825574037726808235944326", "170818353614958581891937302016861126841", "278154899009160441335130137202641445200"], "threshold":0.9}, "id":"ASB-A-496614216-cdedcef2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/31264a30a551ac19aaaec79ff875f483b0f7724a", "target":{"file":"pngwrite.c"}}, {"deprecated":false, "digest":{"function_hash":"181809372360778135365659772572571466078", "length":1154}, "id":"ASB-A-496614216-d0d32d4c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/31264a30a551ac19aaaec79ff875f483b0f7724a", "target":{"file":"pngset.c", "function":"png_set_PLTE"}}, {"deprecated":false, "digest":{"function_hash":"213957024040271508681494972943491585358", "length":1508}, "id":"ASB-A-496614216-daa39a54", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/31264a30a551ac19aaaec79ff875f483b0f7724a", "target":{"file":"pngread.c", "function":"png_read_destroy"}}, {"deprecated":false, "digest":{"function_hash":"261304792064467024282742116954189039042", "length":4192}, "id":"ASB-A-496614216-fafd4552", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/0b1ac71af18303ed4b89255f1db7c45a70351e15", "target":{"file":"pngrtran.c", "function":"png_read_transform_info"}}]}}, {"package":{"name":"platform/external/libpng", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-11-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libpng/+/e3def77d97918d5dad7832223086d0fe4da5d97a", "https://android.googlesource.com/platform/external/libpng/+/baa75ef5fe0a1e7f6b2545d6f5ef3714728e7047", "https://android.googlesource.com/platform/external/libpng/+/b62cd650d9a1b94e5a3642a024f79f4cded7c0dc", "https://android.googlesource.com/platform/external/libpng/+/e366f3972139219f523e7bac4c627f96d4915e2f"], "severity":"Critical", "spl":"2026-11-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["98250150014725793241419848892413636482", "178195276882115633313296615493177798347", "25821686872119194689388687505844949308", "227026791080689077429011535169474272442", "330282194084099661137173723318868244171", "107706244600529939118018940606878508341", "178700209567818827418407780831917929359", "287471555282919382848424250461084643241", "209745718595423869275787055612001785623", "2193192155644361006466675754143514414", "141909920218320054918118988767399339265", "26768757656783073233094152591480478634", "40812701347163550374053105626947511165"], "threshold":0.9}, "id":"ASB-A-496614216-0bc98df4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/e3def77d97918d5dad7832223086d0fe4da5d97a", "target":{"file":"pngset.c"}}, {"deprecated":false, "digest":{"line_hashes":["3440380680870728141840740884913181935", "194675352698992964869628188225393571793", "286290118669996794184809476503204994858"], "threshold":0.9}, "id":"ASB-A-496614216-28e5ffe0", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/e366f3972139219f523e7bac4c627f96d4915e2f", "target":{"file":"pngrtran.c"}}, {"deprecated":false, "digest":{"line_hashes":["78664929825541045347943804030659098153", "275886753624758850400559950953109869061", "278154899009160441335130137202641445200"], "threshold":0.9}, "id":"ASB-A-496614216-2ec6575c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/e3def77d97918d5dad7832223086d0fe4da5d97a", "target":{"file":"pngwrite.c"}}, {"deprecated":false, "digest":{"line_hashes":["23623163812270411804043276495619393360", "249237697521696422883177204471113927941", "98349001497949537832314024201702512510", "78918956699117434114211950372061766681", "237207366743186671084450212310891543569", "216031739450190108770194427049918952681", "196390267377363788697953867336844267126", "48686845457453161111412298511702194846", "253260827306397238091500280458617225372", "34643465992538610679045217732203960938", "318817520864536858434095433116773382862"], "threshold":0.9}, "id":"ASB-A-496614216-47362de6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/b62cd650d9a1b94e5a3642a024f79f4cded7c0dc", "target":{"file":"pngset.c"}}, {"deprecated":false, "digest":{"line_hashes":["295188705198664353711129016364915234481", "61186881870620331963563260190091368059", "85813034465098086945703998494715198010", "36639532824671943475506617781821801755"], "threshold":0.9}, "id":"ASB-A-496614216-7f759936", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/b62cd650d9a1b94e5a3642a024f79f4cded7c0dc", "target":{"file":"pngrtran.c"}}, {"deprecated":false, "digest":{"function_hash":"304635397398783513978631995226858131043", "length":1390}, "id":"ASB-A-496614216-806571f9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/baa75ef5fe0a1e7f6b2545d6f5ef3714728e7047", "target":{"file":"pngset.c", "function":"png_set_tRNS"}}, {"deprecated":false, "digest":{"function_hash":"181809372360778135365659772572571466078", "length":1154}, "id":"ASB-A-496614216-91e3d27b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/b62cd650d9a1b94e5a3642a024f79f4cded7c0dc", "target":{"file":"pngset.c", "function":"png_set_PLTE"}}, {"deprecated":false, "digest":{"function_hash":"50561903265488059777009644901888514277", "length":6171}, "id":"ASB-A-496614216-93762331", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/b62cd650d9a1b94e5a3642a024f79f4cded7c0dc", "target":{"file":"pngrtran.c", "function":"png_set_quantize"}}, {"deprecated":false, "digest":{"line_hashes":["43864688537629825574037726808235944326", "170818353614958581891937302016861126841", "278154899009160441335130137202641445200"], "threshold":0.9}, "id":"ASB-A-496614216-9b35723e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/b62cd650d9a1b94e5a3642a024f79f4cded7c0dc", "target":{"file":"pngwrite.c"}}, {"deprecated":false, "digest":{"function_hash":"173692133047662245734139657595136211741", "length":1171}, "id":"ASB-A-496614216-9fe5ebaf", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/e3def77d97918d5dad7832223086d0fe4da5d97a", "target":{"file":"pngset.c", "function":"png_set_tRNS"}}, {"deprecated":false, "digest":{"function_hash":"6181938991129466879817268636515152608", "length":1692}, "id":"ASB-A-496614216-a3895b18", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/e3def77d97918d5dad7832223086d0fe4da5d97a", "target":{"file":"pngread.c", "function":"png_read_destroy"}}, {"deprecated":false, "digest":{"function_hash":"261304792064467024282742116954189039042", "length":4192}, "id":"ASB-A-496614216-ad76232a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/e366f3972139219f523e7bac4c627f96d4915e2f", "target":{"file":"pngrtran.c", "function":"png_read_transform_info"}}, {"deprecated":false, "digest":{"function_hash":"236483884268181938566890713142960837813", "length":656}, "id":"ASB-A-496614216-adf142cc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/e3def77d97918d5dad7832223086d0fe4da5d97a", "target":{"file":"pngwrite.c", "function":"png_write_destroy"}}, {"deprecated":false, "digest":{"function_hash":"95039209216747699324711564486998941776", "length":1578}, "id":"ASB-A-496614216-c66abb02", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/b62cd650d9a1b94e5a3642a024f79f4cded7c0dc", "target":{"file":"pngread.c", "function":"png_read_destroy"}}, {"deprecated":false, "digest":{"line_hashes":["227026791080689077429011535169474272442", "330282194084099661137173723318868244171", "107706244600529939118018940606878508341", "178700209567818827418407780831917929359", "287471555282919382848424250461084643241", "25059713478850395472297232412415619623", "158404001942170724082453012292215288017", "273120231683896222383495422854080657245", "264161995622523342792879822668003940787"], "threshold":0.9}, "id":"ASB-A-496614216-d3b629be", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/baa75ef5fe0a1e7f6b2545d6f5ef3714728e7047", "target":{"file":"pngset.c"}}, {"deprecated":false, "digest":{"function_hash":"311015491646152627470899922889670583497", "length":771}, "id":"ASB-A-496614216-e87a4b48", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/b62cd650d9a1b94e5a3642a024f79f4cded7c0dc", "target":{"file":"pngwrite.c", "function":"png_write_destroy"}}, {"deprecated":false, "digest":{"line_hashes":["132271531588699432055803361145099610809", "65959435425179038609954885545663919930", "309074223655768629569164703220595436025", "322267439836006670487936700399879236401", "12150830541721880045790454698624805187", "317024228464654619763612828428494868402", "191979943930225737051145180056805495095", "169730874509956863687399430614975043623", "211794578928073518449791588814755226723"], "threshold":0.9}, "id":"ASB-A-496614216-ebd4e28c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/e3def77d97918d5dad7832223086d0fe4da5d97a", "target":{"file":"pngread.c"}}, {"deprecated":false, "digest":{"line_hashes":["117014855185263494942688330135686104575", "325752230950023682901889462812000934508", "54327872665649901308013752597204569586", "162546633693826527505656352290049025683", "276425541579252735905723904052126907315", "60710387181426351393555820526981427402", "206950420709034598758692366423367440074", "245759719882350592384312250931872612852", "162728383063999463456796575335251655957"], "threshold":0.9}, "id":"ASB-A-496614216-f34dbcad", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/b62cd650d9a1b94e5a3642a024f79f4cded7c0dc", "target":{"file":"pngread.c"}}]}}, {"package":{"name":"platform/external/libpng", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-11-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libpng/+/7564535cc02982be5c4c94575ceee020d0d83d09", "https://android.googlesource.com/platform/external/libpng/+/843a0c7aa1f7df6dae8f59554e22f13deeaca4c8", "https://android.googlesource.com/platform/external/libpng/+/02419d5d948e7fa5c161caef792965261521af33", "https://android.googlesource.com/platform/external/libpng/+/ad894509aa70a23a186db9c94cc17b4d2e8f9ed6"], "severity":"Critical", "spl":"2026-11-01", "types":["RCE"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["132271531588699432055803361145099610809", "65959435425179038609954885545663919930", "309074223655768629569164703220595436025", "322267439836006670487936700399879236401", "12150830541721880045790454698624805187", "317024228464654619763612828428494868402", "191979943930225737051145180056805495095", "169730874509956863687399430614975043623", "211794578928073518449791588814755226723"], "threshold":0.9}, "id":"ASB-A-496614216-1ee4465f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/7564535cc02982be5c4c94575ceee020d0d83d09", "target":{"file":"pngread.c"}}, {"deprecated":false, "digest":{"line_hashes":["43864688537629825574037726808235944326", "170818353614958581891937302016861126841", "278154899009160441335130137202641445200"], "threshold":0.9}, "id":"ASB-A-496614216-46563a50", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/02419d5d948e7fa5c161caef792965261521af33", "target":{"file":"pngwrite.c"}}, {"deprecated":false, "digest":{"function_hash":"313132398624434139521442748785736498765", "length":1622}, "id":"ASB-A-496614216-58875a94", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/7564535cc02982be5c4c94575ceee020d0d83d09", "target":{"file":"pngread.c", "function":"png_read_destroy"}}, {"deprecated":false, "digest":{"function_hash":"104995617569394406924752955671276194078", "length":1171}, "id":"ASB-A-496614216-58cecfa1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/7564535cc02982be5c4c94575ceee020d0d83d09", "target":{"file":"pngset.c", "function":"png_set_tRNS"}}, {"deprecated":false, "digest":{"function_hash":"92346968262023918394137732257582612971", "length":1390}, "id":"ASB-A-496614216-642ce25a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/843a0c7aa1f7df6dae8f59554e22f13deeaca4c8", "target":{"file":"pngset.c", "function":"png_set_tRNS"}}, {"deprecated":false, "digest":{"line_hashes":["98250150014725793241419848892413636482", "178195276882115633313296615493177798347", "25821686872119194689388687505844949308", "227026791080689077429011535169474272442", "330282194084099661137173723318868244171", "107706244600529939118018940606878508341", "65398995649560083973584865098452220497", "336357122771267121120931817185345940114", "133925836118369593578454996285940482609", "186644610073406992258916259831369404344", "152406728075571539182669231482024968690", "26768757656783073233094152591480478634", "40812701347163550374053105626947511165"], "threshold":0.9}, "id":"ASB-A-496614216-6616386a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/7564535cc02982be5c4c94575ceee020d0d83d09", "target":{"file":"pngset.c"}}, {"deprecated":false, "digest":{"line_hashes":["78664929825541045347943804030659098153", "275886753624758850400559950953109869061", "278154899009160441335130137202641445200"], "threshold":0.9}, "id":"ASB-A-496614216-678bb3fc", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/7564535cc02982be5c4c94575ceee020d0d83d09", "target":{"file":"pngwrite.c"}}, {"deprecated":false, "digest":{"function_hash":"181809372360778135365659772572571466078", "length":1154}, "id":"ASB-A-496614216-70df967a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/02419d5d948e7fa5c161caef792965261521af33", "target":{"file":"pngset.c", "function":"png_set_PLTE"}}, {"deprecated":false, "digest":{"line_hashes":["117014855185263494942688330135686104575", "325752230950023682901889462812000934508", "54327872665649901308013752597204569586", "162546633693826527505656352290049025683", "276425541579252735905723904052126907315", "60710387181426351393555820526981427402", "206950420709034598758692366423367440074", "245759719882350592384312250931872612852", "162728383063999463456796575335251655957"], "threshold":0.9}, "id":"ASB-A-496614216-72db1b62", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/02419d5d948e7fa5c161caef792965261521af33", "target":{"file":"pngread.c"}}, {"deprecated":false, "digest":{"line_hashes":["23623163812270411804043276495619393360", "249237697521696422883177204471113927941", "98349001497949537832314024201702512510", "78918956699117434114211950372061766681", "237207366743186671084450212310891543569", "216031739450190108770194427049918952681", "196390267377363788697953867336844267126", "48686845457453161111412298511702194846", "253260827306397238091500280458617225372", "34643465992538610679045217732203960938", "318817520864536858434095433116773382862"], "threshold":0.9}, "id":"ASB-A-496614216-7dfd277d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/02419d5d948e7fa5c161caef792965261521af33", "target":{"file":"pngset.c"}}, {"deprecated":false, "digest":{"function_hash":"160601585003269099030650680031230944203", "length":4213}, "id":"ASB-A-496614216-8b6e8fe8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/ad894509aa70a23a186db9c94cc17b4d2e8f9ed6", "target":{"file":"pngrtran.c", "function":"png_read_transform_info"}}, {"deprecated":false, "digest":{"line_hashes":["295188705198664353711129016364915234481", "61186881870620331963563260190091368059", "85813034465098086945703998494715198010", "36639532824671943475506617781821801755"], "threshold":0.9}, "id":"ASB-A-496614216-96e8054f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/02419d5d948e7fa5c161caef792965261521af33", "target":{"file":"pngrtran.c"}}, {"deprecated":false, "digest":{"line_hashes":["3440380680870728141840740884913181935", "194675352698992964869628188225393571793", "286290118669996794184809476503204994858"], "threshold":0.9}, "id":"ASB-A-496614216-9d44dfcf", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/ad894509aa70a23a186db9c94cc17b4d2e8f9ed6", "target":{"file":"pngrtran.c"}}, {"deprecated":false, "digest":{"function_hash":"236483884268181938566890713142960837813", "length":656}, "id":"ASB-A-496614216-a4eda740", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/7564535cc02982be5c4c94575ceee020d0d83d09", "target":{"file":"pngwrite.c", "function":"png_write_destroy"}}, {"deprecated":false, "digest":{"line_hashes":["227026791080689077429011535169474272442", "330282194084099661137173723318868244171", "107706244600529939118018940606878508341", "65398995649560083973584865098452220497", "336357122771267121120931817185345940114", "204683265800026065754952497666826345906", "158404001942170724082453012292215288017", "273120231683896222383495422854080657245", "264161995622523342792879822668003940787"], "threshold":0.9}, "id":"ASB-A-496614216-a6634370", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/843a0c7aa1f7df6dae8f59554e22f13deeaca4c8", "target":{"file":"pngset.c"}}, {"deprecated":false, "digest":{"function_hash":"213957024040271508681494972943491585358", "length":1508}, "id":"ASB-A-496614216-c9597025", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/02419d5d948e7fa5c161caef792965261521af33", "target":{"file":"pngread.c", "function":"png_read_destroy"}}, {"deprecated":false, "digest":{"function_hash":"281894090326528060545578897498635518769", "length":6318}, "id":"ASB-A-496614216-d0bc27d4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/02419d5d948e7fa5c161caef792965261521af33", "target":{"file":"pngrtran.c", "function":"png_set_quantize"}}, {"deprecated":false, "digest":{"function_hash":"311015491646152627470899922889670583497", "length":771}, "id":"ASB-A-496614216-eb09d47e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/external/libpng/+/02419d5d948e7fa5c161caef792965261521af33", "target":{"file":"pngwrite.c", "function":"png_write_destroy"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}]}