The libpng library in Red Hat Enterprise Linux 9 contains a use-after-free vulnerability (CVE-2026-33416) that allows arbitrary code execution. This security flaw arises from improper memory handling within libpng functions that create and manipulate PNG image files. Red Hat has issued an advisory (RHSA-2026:18028) and released updated libpng packages to fix this vulnerability. The advisory covers multiple architectures and variants of Red Hat Enterprise Linux 9. No CVSS score is provided in the advisory, but the issue is rated as moderate severity. There are no known active exploits in the wild.

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code on affected systems. This could lead to system compromise or unauthorized actions performed with the privileges of the vulnerable application. The vulnerability affects libpng, a widely used library for PNG image processing, potentially impacting any software relying on it within Red Hat Enterprise Linux 9 environments.

Red Hat has released updated libpng packages that fix this vulnerability. Users should apply the security update as described in Red Hat advisory RHSA-2026:18028 and the related article https://access.redhat.com/articles/11258. Applying these official patches will remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.