CVE-2026-118475
Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in Eye of GNOME via Malformed PNG Metadata

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: redhat-SADP

Description
A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the application to read past the allocated buffer. This issue can lead to an application crash, resulting in a Denial of Service (DoS), or potentially expose sensitive memory contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-118475
EUVD
EUVD-2026-113476

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-118475 is a buffer overrun vulnerability in Eye of GNOME, a default image viewer for GNOME desktops. It occurs when parsing a maliciously crafted PNG image with improperly formatted color profile metadata. The application fails to validate chunk boundaries while searching for a null terminator, leading to a buffer overrun.

Detection Guidance

To detect this vulnerability, monitor Eye of GNOME (eog) for crashes when opening PNG images. Use tools like AddressSanitizer (ASan) to identify buffer overruns during image processing. Check for malformed PNG files with non-standard iCCP chunks containing non-NULL-terminated profile names.

Impact Analysis

This vulnerability could allow an attacker to crash the application, causing a Denial of Service (DoS). It may also potentially expose sensitive memory contents. Exploitation requires user interaction, as the victim must open the malicious image in an interactive session.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing sensitive memory contents through a buffer overrun. If exploited, it may lead to unauthorized access to personal or health data, violating confidentiality requirements under these regulations.

Mitigation Strategies

Immediately update Eye of GNOME to version 50.4 or later, which includes a patch for this issue. Avoid opening untrusted PNG images until the update is applied. If updating is not possible, restrict access to the eog application to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118475. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart