A heap-based buffer overflow vulnerability exists in the PNG metadata reader of Eye of GNOME (eog) due to improper state handling when parsing split metadata chunks. This flaw could be triggered by a user opening a specially crafted PNG file, potentially causing a denial of service via application crash or arbitrary code execution. The vulnerability affects versions of eog prior to 44.3-2.oe2403sp1. A security update fixing this issue is available.