CVE-2026-34757 | libpng up to 1.6.56 Chunk Setter API png_set_hIST use after free

A vulnerability labeled as critical has been found in libpng up to 1.6.56. The impacted element is the function png_set_hIST of the component Chunk Setter API. Executing a manipulation can lead to use after free.

This vulnerability is handled as CVE-2026-34757. The attack can be executed remotely. There is not any exploit available.

The affected component should be upgraded.