ELA-1877-1 eog security update

multiple vulnerabilities

2026-10-31

Two vulnerabilities were discovered in Eye of GNOME (eog), a lightweight image viewer:

CVE-2026-107651: A heap-based buffer overflow existed in the PNG metadata reader due to improper state handling when parsing split metadata chunks. A remote attacker could have exploited this flaw by enticing a user into opening a specially crafted .png file, potentially leading to arbitrary code execution or a Denial of Service (DoS) via crashing the application.
CVE-2026-118475: When parsing a specially crafted PNG image containing malformed color profile metadata, eog failed to validate chunk boundaries while searching for a null terminator. An attacker could have tricked a user into opening a malicious image, causing the application to read past the allocated buffer. This issue could also have led to an application crash, resulting in a Denial of Service (DoS) or potentially exposing sensitive memory contents.

For Debian 10 buster, these problems have been fixed in version 3.28.4-2+deb10u1.

For Debian 11 bullseye, these problems have been fixed in version 3.38.2-1+deb11u1.

We recommend that you upgrade your eog packages.

Further information about Extended LTS security advisories can be found in the dedicated section of our website.