Github search: png_get_PLTE<p><pre><code>    C    48892
    C++   2916
    Obj-C   36
</code></pre>
Apple programmers aren&#x27;t using it directly at least. Nor Android, which is not exploitable[1]. Chromium also uses SKIA I believe. The C number is obviously inflated by the number of repositories that contain a copy of libpng.<p>If everyone is using common glue code then I think it&#x27;s more likely this won&#x27;t be a problem since the middleware library probably noticed the bug and works around it. It&#x27;s when developers hastily reinvent the wheel that sloppy validation bugs like this are problems. It&#x27;s why the maxim &quot;never write your own crypto&quot; exists. Or as Mark Twain said[2], &quot;put all your eggs in one basket and _watch_that_basket_.&quot;<p>But as I said, there&#x27;s no actual buffer overflow in libpng. This is a validation bug. The headline and the NVD summary are misleading.<p>[1]<a href="https:&#x2F;&#x2F;android.googlesource.com&#x2F;platform&#x2F;external&#x2F;skia&#x2F;+&#x2F;master&#x2F;src&#x2F;codec&#x2F;SkCodec_libpng.cpp#171" rel="nofollow">https:&#x2F;&#x2F;android.googlesource.com&#x2F;platform&#x2F;external&#x2F;skia&#x2F;+&#x2F;ma...</a><p>[2]maybe