CVE-2026-58936 In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is...
CriticalCVSS 9.8
EPSS 0.31%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Google Android | = 17 | No fix listed |
| Google Android | = 16-qpr2 | No fix listed |
| Google Android | = 16 | No fix listed |
| Google Android | = 15 | No fix listed |
| Google Android | = 14 | No fix listed |
| Google Android | = 14.0 | No fix listed |
| Google Android | = 15.0 | No fix listed |
| Google Android | = 16.0 | No fix listed |
| Google Android | = 16.0-qpr2 | No fix listed |
| Google Android | = 17.0 | No fix listed |
References
- source.android.com vendor-advisory