Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-40930 is a vulnerability in libpng that allows remote attackers to craft malicious Animated PNG files which cause the application to misinterpret attacker-controlled data as a new chunk header. This can lead to denial of service or unexpected application behavior impacting data integrity and availability. Red Hat released updated RPM packages for Red Hat Hardened Images, including libpng version 1.6.58-1.hum1, to fix this issue. The advisory does not provide a direct patch link but references updated RPMs. No known exploits have been reported in the wild, and no alternative mitigations meet Red Hat's deployment criteria.

The vulnerability can cause denial of service or unexpected application behavior by corrupting the processing of PNG/APNG files, potentially affecting data integrity and availability. There is no evidence of exploitation in the wild. The impact is considered moderate.

Red Hat has released updated RPM packages for Red Hat Hardened Images including libpng version 1.6.58-1.hum1 that address this vulnerability. Users should apply these updates as per Red Hat's advisory instructions. No other mitigations are currently recommended or meet Red Hat's criteria. Patch status is confirmed by the vendor advisory.