CVE-2026-58936: Critical RCE in PNG use-after-free

CVE-2026-58936 is a use-after-free error in the png_set_tRNS function in pngset.c. The vulnerability allows an attacker to trigger memory corruption, leading to remote code execution (RCE). It affects systems processing PNG files, including Android and other environments using libpng.

The reported CVSS is 9.8, the highest severity. The vulnerability enables RCE without requiring additional privileges or user interaction: processing a malicious PNG is sufficient. It was published on NVD on November 2, 2026 and is included in November security updates for Android, where it ranks among 23 critical CVEs. Online signals show recent discussion of the vulnerability across industry channels.

IT administrators and security teams must apply November 2026 patches immediately on all Android systems and infrastructure using libpng for image processing. It is essential to audit current endpoints, file transfer services and browsers processing PNG. Monitor logs for anomalous access and attempts to process malformed PNG files. Complete patching within 48 hours for critical environments.