OESA-2026-4557: eog security update

Q: What does an attacker need to exploit this issue?

An attacker needs to persuade a user to open a specially crafted PNG file in EOG. The supplied vector indicates local attack access and user interaction are required; no privileges are required.

Q: Who is exposed?

Users of the openEuler EOG package are exposed when they open untrusted PNG files with EOG. The issue is in PNG metadata parsing, specifically handling split metadata chunks.

Q: What can happen if exploitation succeeds?

A crafted PNG can trigger a heap-based buffer overflow, potentially resulting in arbitrary code execution or an EOG application crash that causes denial of service.

Q: What can be done before an update is applied?

Avoid opening PNG files from untrusted or unexpected sources in EOG, particularly files received through phishing or other unsolicited channels. Use an alternative image viewer for files that must be inspected until the security update can be applied.

Published Oct 29, 2026

Updated

EOG is an application used for viewing and cataloging image files on the GNOME Desktop.It has basic editing capabilites. Security Fix(es):

A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata chunks. A remote attacker could exploit this flaw by enticing a user into opening a specially crafted PNG file, potentially leading to arbitrary code execution or a Denial of Service (DoS) via application crash.(CVE-2026-107651)

Affected Software

1 affected componentFixes available

openeuler/eog<44.3-2.oe2403sp1

44.3-2.oe2403sp1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/eog to a version that resolves this vulnerability.
Fixed in 44.3-2.oe2403sp1

Event History

Oct 29, 2026

Advisory Published

via OSV·09:02 AM

Data Sourced

via OSV·09:02 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-107651

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to persuade a user to open a specially crafted PNG file in EOG. The supplied vector indicates local attack access and user interaction are required; no privileges are required.

Who is exposed?

Users of the openEuler EOG package are exposed when they open untrusted PNG files with EOG. The issue is in PNG metadata parsing, specifically handling split metadata chunks.

What can happen if exploitation succeeds?

A crafted PNG can trigger a heap-based buffer overflow, potentially resulting in arbitrary code execution or an EOG application crash that causes denial of service.

What can be done before an update is applied?

Avoid opening PNG files from untrusted or unexpected sources in EOG, particularly files received through phishing or other unsolicited channels. Use an alternative image viewer for files that must be inspected until the security update can be applied.

OESA-2026-4557: eog security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is exposed?

What can happen if exploitation succeeds?

What can be done before an update is applied?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is exposed?

What can happen if exploitation succeeds?

What can be done before an update is applied?