CVE-2026-118475

A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the application to read past the allocated buffer. This issue can lead to an application crash, resulting in a Denial of Service (DoS), or potentially expose sensitive memory contents.

This vulnerability is rated as Moderate impact because exploitation requires user interaction to open a specially crafted image in an interactive desktop session, limiting the blast radius to the permissions of the local user. Eye of GNOME is an interactive desktop utility typically installed in workstation configurations and is not exposed as a listening network service. Successful exploitation is constrained to local application crashes or limited heap memory disclosure during metadata processing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.