Description
A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata chunks. A remote attacker could exploit this flaw by enticing a user into opening a specially crafted PNG file, potentially leading to arbitrary code execution or a Denial of Service (DoS) via application crash.
Published: 2026-10-08
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Assess Impact
AI Analysis

Impact

A heap‑based buffer overflow exists in the PNG metadata reader of Eye of GNOME due to improper state handling when parsing split metadata chunks. The flaw allows a remote attacker to entice a user into opening a specially crafted PNG file, which could lead to arbitrary code execution or a denial of service if the application crashes. The vulnerability is a classic example of CWE‑122, where a buffer overflow enables control over program execution flow.

Affected Systems

The vulnerability impacts Eye of GNOME distributions shipped with Red Hat Enterprise Linux 6, 7, 8, and 9. No specific product version is listed, but any host with the affected Eye of GNOME installed is at risk.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate severity. EPSS is not available and the flaw is not listed in CISA KEV. Attack requires the user to open a malicious PNG image, implying local or user‑initiated exposure. Because no workaround is provided and a patch is pending, the risk profile remains moderate while awaiting vendor remediation. The potential for arbitrary code execution warrants careful monitoring.

Generated by OpenCVE AI on October 8, 2026 at 23:58 UTC.

Remediation

Vendor Workaround

No mitigation is available for this flaw.

OpenCVE Recommended Actions

  • Apply the vendor patch or update Eye of GNOME as soon as it is released.
  • If Eye of GNOME is not required for your environment, consider uninstalling or disabling the application to eliminate the attack surface.
  • Restrict opening of PNG files from untrusted sources, or run the image viewer in a sandboxed environment to contain potential exploitation.

Generated by OpenCVE AI on October 8, 2026 at 23:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Eog
Eog eog
Vendors & Products Eog
Eog eog

Fri, 09 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 08 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata chunks. A remote attacker could exploit this flaw by enticing a user into opening a specially crafted PNG file, potentially leading to arbitrary code execution or a Denial of Service (DoS) via application crash.
Title Eog: eog: arbitrary code execution via heap buffer overflow in png metadata reader
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-122
CPEs cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Eog Eog
Redhat Enterprise Linux
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-14T01:32:02.554Z

Reserved: 2026-10-08T14:23:37.954Z

Link: CVE-2026-107651

cve-icon Vulnrichment

Updated: 2026-10-14T01:31:59.228Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-08T23:16:57.863

Modified: 2026-10-14T02:16:57.180

Link: CVE-2026-107651

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-08T00:00:00Z

Links: CVE-2026-107651 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T08:02:26Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow