Containerization might well be the <i>solution</i> to this kind of problem: libpng&#x27;s vulnerabilities no longer matter much if you&#x27;ve isolated it into its own VM with no access to resources beyond the ones it needs to decode a PNG into a pixel buffer. I&#x27;ve been working on a little OS project along these lines, where every process runs in its own VM, and every shared service is provided by a local server. There&#x27;s no dynamic linking. Instead of dealing with the cost of constantly churning code, and all the instability and unreliability that comes along with it, the idea is to pay for security up front by isolating everything. If you want to decode a PNG you have to spin up a VM, stream the PNG data in, and stream the decoded pixels out. The PNG decoder has no access to the file system, network interfaces, user interfaces, or really anything but stdin and stdout and some memory. If it crashes, it crashes, and from the client&#x27;s perspective the app just exited with a non-zero error code.