@patchhawk_

🦅 The changelog says "bug fixes." The diff says "security patch." We track CVE-less fixes so defenders don't fly blind. New drop every Thursday. @78_lab

Joined June 2026
  • Tweets163
  • Following2
  • Followers72
In our test, a broken zTXt chunk leaves zlib pointing into libpng’s chunk buffer. The next, larger tEXt chunk frees that buffer. In 1.6.59, libpng clears the pointer before releasing the stream. Patch: github.com/pnggroup/libpng/c…
CVE-2026-46675 in libpng. The PRE panel says this helper did not exist in 1.6.58. The POST panel shows the full new function: it sets next_in and next_out to NULL, then avail_in and avail_out to zero. The other card shows where libpng calls it before releasing the stream.

ALT CVE-2026-46675 in libpng. The PRE panel says this helper did not exist in 1.6.58. The POST panel shows the full new function: it sets next_in and next_out to NULL, then avail_in and avail_out to zero. The other card shows where libpng calls it before releasing the stream.

1
45
libpng 1.6.58 has a use-after-free in an unusual read path. A crafted PNG can make libpng read freed memory if an app calls png_read_end() after png_read_info() but before reading any image rows. Version 1.6.59 fixes it. Advisory: github.com/pnggroup/libpng/s…
CVE-2026-46675 in libpng. Two stacked code panels show the compressed-text release path. In 1.6.58, it only sets zowner to zero. In 1.6.59, it calls png_inflate_detach_buffers first. The error check above and the end of the block remain visible. For a crafted PNG and a read-end call before any image rows, the old path could use a pointer to freed data.

ALT CVE-2026-46675 in libpng. Two stacked code panels show the compressed-text release path. In 1.6.58, it only sets zowner to zero. In 1.6.59, it calls png_inflate_detach_buffers first. The error check above and the end of the block remain visible. For a crafted PNG and a read-end call before any image rows, the old path could use a pointer to freed data.

1
1
80
FreeType later changed SHZ, the instruction that moves points in a glyph. It now picks the right set of points and stops at the end of that set. The two cards show the code. This fix came after 2.14.3. github.com/freetype/freetype…
1
2
2
116
The change is easy to miss. In 2.14.2, FreeType made room for the glyph's existing points, plus four more. In 2.14.3, it only made room for four. That wasn't enough for some glyphs made from other glyphs. github.com/freetype/freetype…
1
2
2
122
Before the fix, PackedImage::Create() allocated after unchecked size arithmetic. The decoder’s output callback then wrote beyond that buffer. The patch calls VerifyDimensions() first and rejects wrapped stride or total size. The card shows the actual code change.
1
2
3
132
Now the filter. On 9.0.1, firequalizer=delay=30000 overflows the FIR-length calculation under UBSan. 9.0.2 rejects that value. But a later signed multiplication, nsamples_max * 2, is still there. Patch: github.com/FFmpeg/FFmpeg/com…
1
2
2
55
In the Ogg demuxer, buf_realloc() doubled an unsigned buffer size without checking the limit first. Near UINT_MAX/2, that can wrap. On 9.0.1, our raised-limit run hit an ASan invalid write (WRITE of size 31895). On 9.0.2, it returns ENOMEM. Patch: github.com/FFmpeg/FFmpeg/com…
1
2
2
117
The patch moves i++ into the inner sample loop and bounds the sample read with i < width. The PRE/POST card focuses on the counter change; the complete patch also adds a bit-depth guard.
1
1
1
60
The DDS reader copied a file-derived pixel width into a 4-byte uint32_t. The patch caps memcpy at sizeof(pixel), then continues extracting the color channels. The destination's capacity now bounds the copy.
1
1
1
54
The 7.7 patch measures the username and suffix before encoding. If their sum exceeds MAX_LOGIN_SZ, Squid rejects the credentials. The card shows the new guard in the peer-login branch; the buffer declaration and encoder sit just outside this excerpt.
1
1
1
59
On Unix, file_put_contents() could create zbx_config_cache as 0644 with umask 022. In 7.0.30, tempnam() creates a 0600 file, writes the JSON, and rename() replaces the cache path. The card shows the actual diff.
1
15
Load more