The vulnerability in libpng affects the ARM/AArch64 Neon-optimized palette expansion path used during decoding of 8-bit paletted PNG images. Specifically, the Neon loop processes the final partial chunk of pixels without confirming that sufficient input pixels remain, leading to out-of-bounds reads and writes by dereferencing pointers before the start of the row buffer. This memory corruption can be triggered by normal decoding of malicious PNG files when Neon optimizations are enabled. The flaw is present in libpng versions from 1.6.36 up to but not including 1.6.56. The issue is fixed in version 1.6.56.

Successful exploitation can lead to memory corruption due to out-of-bounds read and write operations. The CVSS score of 7.6 indicates high severity with potential impacts including limited confidentiality and integrity loss, and high impact on availability. This could cause application crashes or potentially enable further exploitation depending on the context of use.

Upgrade libpng to version 1.6.56 or later, where this vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed by the vendor's versioning information.