On Thu, Apr 09, 2026 at 07:20:33AM +0200, Matthieu Herrb wrote:
> === CVE-2026-34757 ===
> 
> Use-after-free in png_set_PLTE, png_set_tRNS and png_set_hIST
> leading to corrupted chunk data and potential heap information
> disclosure
> 
> no API/ABI change.
> 
> ok ?

ok

> I'll also take case of updating the embedded copy in xenocara,
> used by freetype, although the affected functions are not called by
> freetype afaict.

The diff between the two version reads fine and completely risk-free to
me. ok for this as well. Thanks!