Do Son Researchers reveal critical RCE and ARM-specific flaws in libpng (CVE-2026-33636 & 33416). Affecting decades of apps, these bugs require an immediate update.
PNG
A 30-year-old heap overflow in libpng (CVE-2026-25646) exposes apps to DoS & RCE. The flaw affects all versions since inception. Update to v1.6.55 now.
Splunk uncovered a new .NET steganographic loader that hides LokiBot malware inside embedded BMP and PNG image files. The multi-stage loader uses a separate container module, evading static detection.
PNG 3.0 is now a W3C Recommendation, introducing HDR imaging, native APNG, and EXIF metadata support, significantly enhancing the visual quality and functionality of web images.