OESA-2026-4554: eog security update

Q: What must an attacker do to exploit this issue?

An attacker must persuade a user to open a specially crafted PNG file in EOG. The vulnerability is triggered while EOG parses split PNG metadata chunks.

Q: Who is most exposed?

Users of EOG who open PNG files from untrusted or attacker-controlled sources are exposed. Exploitation requires local interaction by the user, rather than a network-accessible EOG service.

Q: What is the potential impact?

Successful exploitation can cause EOG to crash, resulting in denial of service. The flaw may also potentially allow arbitrary code execution.

Published Oct 29, 2026

Updated

EOG is an application used for viewing and cataloging image files on the GNOME Desktop.It has basic editing capabilites. Security Fix(es):

A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata chunks. A remote attacker could exploit this flaw by enticing a user into opening a specially crafted PNG file, potentially leading to arbitrary code execution or a Denial of Service (DoS) via application crash.(CVE-2026-107651)

Affected Software

1 affected componentFixes available

openeuler/eog<44.3-2.oe2403sp3

44.3-2.oe2403sp3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/eog to a version that resolves this vulnerability.
Fixed in 44.3-2.oe2403sp3

Event History

Oct 29, 2026

Advisory Published

via OSV·09:02 AM

Data Sourced

via OSV·09:02 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-107651

Frequently Asked Questions

What must an attacker do to exploit this issue?

An attacker must persuade a user to open a specially crafted PNG file in EOG. The vulnerability is triggered while EOG parses split PNG metadata chunks.

Who is most exposed?

Users of EOG who open PNG files from untrusted or attacker-controlled sources are exposed. Exploitation requires local interaction by the user, rather than a network-accessible EOG service.

What is the potential impact?

Successful exploitation can cause EOG to crash, resulting in denial of service. The flaw may also potentially allow arbitrary code execution.

OESA-2026-4554: eog security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What must an attacker do to exploit this issue?

Who is most exposed?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

Who is most exposed?

What is the potential impact?