{"id":"ASB-A-496616027","details":"In png_do_expand_palette_rgba8_neon of palette_neon_intrinsics.c, there is a possible out of bounds read and write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-496616027","CVE-2026-33636","GHSA-wjr5-c57x-95m2"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/external/libpng","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libpng/+/d13d190be0e939c968ca9866a296f5c2974de8e9"],"severity":"Critical","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/libpng/+/d13d190be0e939c968ca9866a296f5c2974de8e9","target":{"file":"arm/palette_neon_intrinsics.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["298359708780267296884315157627833435451","203203178321805385143526883075393510811","250242872877104785147844109220919858595","79048702668278991502446076210527555188","171919842259648123697619028366239398012","241268730263835879674777371680796159758","293042023929336437675212565487597359138","102080076162553264016683727533188887257","289421140340610710376227973987476268928","180482023378579750659669637771709492112","136583812222870122331793565768299380396","322726961584630739184609056372871362468","311039951619311631758162993300496042313","215349985471551441045135139639116256526","203660877934709973581203789725256264127","149369019407912671219455789735649947374","288217906790959503968015943118871567353","142502072423275304246426102188211634235","102080076162553264016683727533188887257","289421140340610710376227973987476268928","180482023378579750659669637771709492112","264103051453817654756190448191240629301","41928230139577688963226065437266305186"]},"id":"ASB-A-496616027-1004fa92","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/libpng/+/d13d190be0e939c968ca9866a296f5c2974de8e9","target":{"file":"arm/palette_neon_intrinsics.c","function":"png_do_expand_palette_rgba8_neon"},"deprecated":false,"digest":{"length":841,"function_hash":"128613901959813948094254356666012276707"},"id":"ASB-A-496616027-336e7ab7","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libpng/+/d13d190be0e939c968ca9866a296f5c2974de8e9","target":{"file":"arm/palette_neon_intrinsics.c","function":"png_do_expand_palette_rgb8_neon"},"deprecated":false,"digest":{"length":1253,"function_hash":"191788870158240393335986482985216797006"},"id":"ASB-A-496616027-44ffb86b"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496616027.json"}},{"package":{"name":"platform/external/libpng","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"length":1253,"function_hash":"191788870158240393335986482985216797006"},"id":"ASB-A-496616027-48fea7fa","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libpng/+/10f4ca892a321c39de546a1a8e4d632bfc0852df","target":{"function":"png_do_expand_palette_rgb8_neon","file":"arm/palette_neon_intrinsics.c"}},{"deprecated":false,"digest":{"function_hash":"73469605830962399111124384080506878068","length":825},"id":"ASB-A-496616027-a1ae7716","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libpng/+/10f4ca892a321c39de546a1a8e4d632bfc0852df","target":{"file":"arm/palette_neon_intrinsics.c","function":"png_do_expand_palette_rgba8_neon"}},{"digest":{"line_hashes":["298359708780267296884315157627833435451","203203178321805385143526883075393510811","250242872877104785147844109220919858595","79048702668278991502446076210527555188","171919842259648123697619028366239398012","241268730263835879674777371680796159758","293042023929336437675212565487597359138","102080076162553264016683727533188887257","289421140340610710376227973987476268928","180482023378579750659669637771709492112","136583812222870122331793565768299380396","322726961584630739184609056372871362468","311039951619311631758162993300496042313","215349985471551441045135139639116256526","203660877934709973581203789725256264127","149369019407912671219455789735649947374","288217906790959503968015943118871567353","142502072423275304246426102188211634235","102080076162553264016683727533188887257","289421140340610710376227973987476268928","180482023378579750659669637771709492112","264103051453817654756190448191240629301","41928230139577688963226065437266305186"],"threshold":0.9},"id":"ASB-A-496616027-ccaea1a4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libpng/+/10f4ca892a321c39de546a1a8e4d632bfc0852df","target":{"file":"arm/palette_neon_intrinsics.c"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/external/libpng/+/10f4ca892a321c39de546a1a8e4d632bfc0852df"],"severity":"Critical","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496616027.json"}},{"package":{"name":"platform/external/libpng","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libpng/+/59b59b6c027aaf36e8514d7d527499bd646cdf06","target":{"file":"arm/palette_neon_intrinsics.c","function":"png_do_expand_palette_rgba8_neon"},"deprecated":false,"digest":{"function_hash":"73469605830962399111124384080506878068","length":825},"id":"ASB-A-496616027-7d8c0ab5"},{"digest":{"threshold":0.9,"line_hashes":["298359708780267296884315157627833435451","203203178321805385143526883075393510811","250242872877104785147844109220919858595","79048702668278991502446076210527555188","171919842259648123697619028366239398012","241268730263835879674777371680796159758","293042023929336437675212565487597359138","102080076162553264016683727533188887257","289421140340610710376227973987476268928","180482023378579750659669637771709492112","136583812222870122331793565768299380396","322726961584630739184609056372871362468","311039951619311631758162993300496042313","215349985471551441045135139639116256526","203660877934709973581203789725256264127","149369019407912671219455789735649947374","288217906790959503968015943118871567353","142502072423275304246426102188211634235","102080076162553264016683727533188887257","289421140340610710376227973987476268928","180482023378579750659669637771709492112","264103051453817654756190448191240629301","41928230139577688963226065437266305186"]},"id":"ASB-A-496616027-c1359d44","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libpng/+/59b59b6c027aaf36e8514d7d527499bd646cdf06","target":{"file":"arm/palette_neon_intrinsics.c"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/libpng/+/59b59b6c027aaf36e8514d7d527499bd646cdf06","target":{"function":"png_do_expand_palette_rgb8_neon","file":"arm/palette_neon_intrinsics.c"},"deprecated":false,"digest":{"length":1253,"function_hash":"191788870158240393335986482985216797006"},"id":"ASB-A-496616027-dd546884","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/external/libpng/+/59b59b6c027aaf36e8514d7d527499bd646cdf06"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496616027.json"}},{"package":{"name":"platform/external/libpng","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"Critical","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libpng/+/f5d4f5f7822964cb3753a5b93eab39fbef377aec","target":{"file":"arm/palette_neon_intrinsics.c","function":"png_do_expand_palette_rgb8_neon"},"deprecated":false,"digest":{"length":1253,"function_hash":"191788870158240393335986482985216797006"},"id":"ASB-A-496616027-037ce57f"},{"digest":{"function_hash":"128613901959813948094254356666012276707","length":841},"id":"ASB-A-496616027-62af06a9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libpng/+/f5d4f5f7822964cb3753a5b93eab39fbef377aec","target":{"file":"arm/palette_neon_intrinsics.c","function":"png_do_expand_palette_rgba8_neon"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["298359708780267296884315157627833435451","203203178321805385143526883075393510811","250242872877104785147844109220919858595","79048702668278991502446076210527555188","171919842259648123697619028366239398012","241268730263835879674777371680796159758","293042023929336437675212565487597359138","102080076162553264016683727533188887257","289421140340610710376227973987476268928","180482023378579750659669637771709492112","136583812222870122331793565768299380396","322726961584630739184609056372871362468","311039951619311631758162993300496042313","215349985471551441045135139639116256526","203660877934709973581203789725256264127","149369019407912671219455789735649947374","288217906790959503968015943118871567353","142502072423275304246426102188211634235","102080076162553264016683727533188887257","289421140340610710376227973987476268928","180482023378579750659669637771709492112","264103051453817654756190448191240629301","41928230139577688963226065437266305186"]},"id":"ASB-A-496616027-ee961c9c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libpng/+/f5d4f5f7822964cb3753a5b93eab39fbef377aec","target":{"file":"arm/palette_neon_intrinsics.c"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/external/libpng/+/f5d4f5f7822964cb3753a5b93eab39fbef377aec"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496616027.json"}},{"package":{"name":"platform/external/libpng","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"length":841,"function_hash":"128613901959813948094254356666012276707"},"id":"ASB-A-496616027-3179c2c9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libpng/+/7d98050ef8d9d17d495eb178b8217548437cedf1","target":{"file":"arm/palette_neon_intrinsics.c","function":"png_do_expand_palette_rgba8_neon"},"deprecated":false},{"id":"ASB-A-496616027-8e75770f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libpng/+/7d98050ef8d9d17d495eb178b8217548437cedf1","target":{"file":"arm/palette_neon_intrinsics.c","function":"png_do_expand_palette_rgb8_neon"},"deprecated":false,"digest":{"length":1253,"function_hash":"191788870158240393335986482985216797006"}},{"target":{"file":"arm/palette_neon_intrinsics.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["298359708780267296884315157627833435451","203203178321805385143526883075393510811","250242872877104785147844109220919858595","79048702668278991502446076210527555188","171919842259648123697619028366239398012","241268730263835879674777371680796159758","293042023929336437675212565487597359138","102080076162553264016683727533188887257","289421140340610710376227973987476268928","180482023378579750659669637771709492112","136583812222870122331793565768299380396","322726961584630739184609056372871362468","311039951619311631758162993300496042313","215349985471551441045135139639116256526","203660877934709973581203789725256264127","149369019407912671219455789735649947374","288217906790959503968015943118871567353","142502072423275304246426102188211634235","102080076162553264016683727533188887257","289421140340610710376227973987476268928","180482023378579750659669637771709492112","264103051453817654756190448191240629301","41928230139577688963226065437266305186"]},"id":"ASB-A-496616027-bc28fab2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libpng/+/7d98050ef8d9d17d495eb178b8217548437cedf1"}],"fixes":["https://android.googlesource.com/platform/external/libpng/+/7d98050ef8d9d17d495eb178b8217548437cedf1"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496616027.json"}},{"package":{"name":"platform/external/libpng","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libpng/+/878709359441be2cbee8a0fa1b42af6a3bac6c18","target":{"file":"arm/palette_neon_intrinsics.c","function":"png_do_expand_palette_rgba8_neon"},"deprecated":false,"digest":{"function_hash":"73469605830962399111124384080506878068","length":825},"id":"ASB-A-496616027-4004b8b2"},{"target":{"file":"arm/palette_neon_intrinsics.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["298359708780267296884315157627833435451","203203178321805385143526883075393510811","250242872877104785147844109220919858595","79048702668278991502446076210527555188","171919842259648123697619028366239398012","241268730263835879674777371680796159758","293042023929336437675212565487597359138","102080076162553264016683727533188887257","289421140340610710376227973987476268928","180482023378579750659669637771709492112","136583812222870122331793565768299380396","322726961584630739184609056372871362468","311039951619311631758162993300496042313","215349985471551441045135139639116256526","203660877934709973581203789725256264127","149369019407912671219455789735649947374","288217906790959503968015943118871567353","142502072423275304246426102188211634235","102080076162553264016683727533188887257","289421140340610710376227973987476268928","180482023378579750659669637771709492112","264103051453817654756190448191240629301","41928230139577688963226065437266305186"]},"id":"ASB-A-496616027-55a761b5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libpng/+/878709359441be2cbee8a0fa1b42af6a3bac6c18"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libpng/+/878709359441be2cbee8a0fa1b42af6a3bac6c18","target":{"function":"png_do_expand_palette_rgb8_neon","file":"arm/palette_neon_intrinsics.c"},"deprecated":false,"digest":{"function_hash":"191788870158240393335986482985216797006","length":1253},"id":"ASB-A-496616027-9477d6d5"}],"fixes":["https://android.googlesource.com/platform/external/libpng/+/878709359441be2cbee8a0fa1b42af6a3bac6c18"],"severity":"Critical","spl":"2026-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-496616027.json"}}],"schema_version":"1.9.0"}