libpng 1.6.57 - April 8, 2026
=============================

This is a public release of libpng, intended for use in production code.


Files available for download
----------------------------

Source files:

 * libpng-1.6.57.tar.xz (LZMA-compressed, recommended)
 * libpng-1.6.57.tar.gz (deflate-compressed)
 * lpng1657.7z (LZMA-compressed)
 * lpng1657.zip (deflate-compressed)

Other information:

 * README.md
 * LICENSE.md
 * AUTHORS.md
 * TRADEMARK.md


Changes from version 1.6.56 to version 1.6.57
---------------------------------------------

 * Fixed CVE-2026-34757 (medium severity):
   Use-after-free in `png_set_PLTE`, `png_set_tRNS` and `png_set_hIST`
   leading to corrupted chunk data and potential heap information disclosure.
   Also hardened the append-style setters (`png_set_text`, `png_set_sPLT`,
   `png_set_unknown_chunks`) against a theoretical variant of the same
   aliasing pattern.
   (Reported by Iv4n <Iv4n550@users.noreply.github.com>.)
 * Fixed integer overflow in rowbytes computation in read transforms.
   (Contributed by Mohammad Seet.)


Send comments/corrections/commendations to png-mng-implement at lists.sf.net.
Subscription is required; visit
<https://lists.sourceforge.net/lists/listinfo/png-mng-implement>
to subscribe.