The vulnerability is a buffer overrun triggered when Eye of GNOME parses a PNG file that contains a malformed ICCP chunk. The application does not correctly validate the chunk length when looking for a null terminator, allowing an attacker to read past the bounds of an allocated byte array. This can cause the viewer to crash, resulting in denial of service. Because the overflow occurs in user mode it does not immediately lead to privilege escalation but may expose data on the heap, enabling potential information disclosure.

Affected versions of Red Hat Enterprise Linux 6, 7, 8, and 9 include the GNOME Image Viewer (eog) packages that have the vulnerable implementation. Each OS distribution ships the same source code from the GNOME project, so any machine running the default EOG package on these RHEL versions is susceptible. No specific version numbers are listed, so all installed instances of EOG until the vendor’s update are considered vulnerable.

The CVSS base score is 3.6, indicating a low severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. The attack scenario requires user interaction—opening a malicious image—to trigger the flaw. If a user opens such a file, the viewer will crash; the situation is unlikely to compromise other components of the system. Therefore the overall risk is low to moderate, primarily affecting application availability.