Eye of GNOME (eog) contains a heap-based buffer overflow vulnerability in its PNG metadata reader caused by improper state handling when parsing split metadata chunks. This flaw can be triggered when a user opens a specially crafted PNG file, potentially causing a denial of service via application crash. The vulnerability has been fixed in version 3.38.3-5.oe2203sp4.