1.6.56 is release fixes for the following two security vulnerabilities:
CVE-2026-33416 (high severity): Use-after-free memory bug in the transparency and palette-handling code. Similar to its predecessor CVE-2026-25646, this latent bug has existed for 25 years. Both Halil Oktay and Ryo Shimada discovered it within days of one another.
CVE-2026-33636 (high severity): Out-of-bounds read and write vulnerability in the ARM Neon palette-expansion code. This one was found and fixed by Taegu Ha and has existed since 1.6.36.
The images that trigger these bugs are valid. Users are encouraged to update immediately.
Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:
sudo dnf upgrade --refresh --advisory=FEDORA-2026-c6c617fe35Please log in to add feedback.
| 0 | 0 | Test Case libpng image view |
This update has been submitted for testing by mhlavink.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'failed'.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'passed'.
This update has been pushed to testing.
Works.
This update can be pushed to stable now if the maintainer wishes
no regressions noted
This update has been submitted for stable by bodhi.
There is an ongoing freeze; this will be pushed to stable after the freeze is over.
This update has been pushed to stable.