<i>If</i> that&#x27;s the case, <i>and</i> bpp is always 8 or less, then software where the programmers were &quot;lazy&quot; and always allocated 256 entries for the palette might not be vulnerable.<p>From a quick search in MXR (<a href="https:&#x2F;&#x2F;mxr.mozilla.org&#x2F;mozilla-central&#x2F;" rel="nofollow">https:&#x2F;&#x2F;mxr.mozilla.org&#x2F;mozilla-central&#x2F;</a>) for the identifiers &quot;png_set_PLTE&quot; and &quot;png_set_PLTE&quot;, it seems that at least Mozilla (Firefox) did the lazy thing and always allocated 256 entries.<p>Edit: I was right, from <a href="https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=1224244" rel="nofollow">https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=1224244</a> &quot;Mozilla is not vulnerable to the security issues that it fixes, when using either the in-tree libpng or the system libpng.&quot;