A heap-based buffer overflow vulnerability exists in the PNG metadata reader of Eye of GNOME (eog) due to improper state handling when parsing split metadata chunks. This flaw could be exploited by a remote attacker who convinces a user to open a specially crafted PNG file, potentially causing a denial of service via application crash. The vulnerability is fixed in version 44.3-2.oe2403sp3.