CVE-2026-118475: Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunk
A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the application to read past the allocated buffer. This issue can lead to an application crash, resulting in a Denial of Service (DoS), or potentially expose sensitive memory contents.
Other sources
Summary: Possible buffer overrun when parsing malicious PNG files with non-standard iCCP chunk Requirements to exploit: A manipulated PNG file with a iCCP chunk that doesn't follow the PNG specification Component affected: Eye of GNOME (eog) Version affected: 2.23.1 <= eog <= 50.3 Patch available: Yes, https://gitlab.gnome.org/GNOME/eog/-/commit/04e4f313421eacb9fc529781542bb7fb81a3cd1a Version fixed (if any already): 50.4 Upstream coordination: See issue report (below) CVSS (optional): Impact (optional): Embargo: No Acknowledgment: PoC script by Ege BALCI Steps to reproduce if available: see issue report Mitigation if available: None Original report:
See https://gitlab.gnome.org/GNOME/eog/-/issues/342#note2903549
This was noticed while verifiying the fix for CVE-2026-107651. The PoC script accompanying that CVE produces PNG files which don't start their iCCP chunks with a NULL-terminated profile name, as mandated by the PNG specification. Intead the chunk us only filled with 'A'.
Once Eye of GNOME loads one of these files it will try to extract the ICC profile from the PNG files. For that it calls eogmetadatareaderpnggeticcprofile() the code tries to skip over the profile name, by walking over the chunk data looking for the first NULL byte. Since it doesn't keep track of the chunk's size it will eventually read past the allocated chunk data.
This is so far only reproducible in ASan enabled builds, in normal builds it seems to "find" a NULL-byte directly after the chunk data.
The issue was fixed already in release 50.4 using the patch linked above
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/eogto a version that resolves this vulnerability.Fixed in 50.4-1 - Upgrade
Upgrade
Eye of GNOME (eog)to a version that resolves this vulnerability.Fixed in 50.4
Event History
Frequently Asked Questions
Which installations are affected?
Eye of GNOME (eog) versions from 2.23.1 through 50.3 are affected. The listed software entries are Ubuntu eog and Debian eog; version 50.4 is identified as fixed.
What does exploitation require?
An attacker needs to provide a manipulated PNG containing an iCCP chunk that does not follow the PNG specification, then trick a user into opening that image in Eye of GNOME. The CVSS vector indicates local attack access, high attack complexity, no required privileges, and user interaction.
What is the practical impact?
Parsing the malformed color-profile metadata can cause Eye of GNOME to read beyond its allocated buffer. This can crash the application, causing denial of service, and may expose sensitive memory contents.
What should be done if patching is not immediately possible?
No mitigation is provided in the available data. Until an update is applied, avoid opening untrusted PNG files in the affected application, particularly files that may contain malformed iCCP metadata.
How can I remediate the issue?
Update Eye of GNOME to version 50.4 or later, which includes the referenced upstream patch.