A flaw was found in Eye of GNOME (eog). (CVE-2026-107651)

CVE-2026-107651 describes a heap-based buffer overflow in Eye of GNOME's PNG metadata reader. The flaw arises from improper state handling when parsing split metadata chunks in PNG files. A remote attacker can exploit this by convincing a user to open a malicious PNG file, which may lead to arbitrary code execution or a denial of service through application crash. The vulnerability affects numerous explicitly listed eog versions. The CVSS 3.1 base score is 5.5 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, but high availability impact.

Exploitation requires local access and user interaction (opening a malicious PNG file). Successful exploitation can cause application crashes (denial of service) or potentially arbitrary code execution. There is no impact on confidentiality or integrity. The medium CVSS score reflects the limited attack vector and required user interaction but significant availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening untrusted PNG files with Eye of GNOME. Monitor vendor channels for official patches or updates addressing this vulnerability.