CVE-2026-107651

A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata chunks. A remote attacker could exploit this flaw by enticing a user into opening a specially crafted PNG file, potentially leading to arbitrary code execution or a Denial of Service (DoS) via application crash.

This vulnerability is rated as Moderate impact for Red Hat products because successful exploitation requires user interaction to open a maliciously crafted image file within the desktop image viewer. Although parsing corrupted metadata could theoretically result in memory corruption or arbitrary code execution, execution is constrained to the privileges of the active desktop user and cannot be triggered automatically without direct user involvement. Furthermore, server deployments running headless or without graphical desktop environments installed are not exposed to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is available for this flaw.