Live › vulnerability › CVE-2026-118475
Eye of GNOME, the GNOME image viewer, mishandles a PNG file with malformed color profile metadata and reads past a buffer. An attacker who tricks a user into opening the image can crash the app or possibly expose nearby memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 02:28 UTC. All times on this page are UTC.
Anyone who opens untrusted PNG files in Eye of GNOME on a desktop Linux system is exposed, since the attack needs a user to open a crafted image. Systems that do not run Eye of GNOME, or only open images from trusted sources, are at lower risk. The sources do not name affected versions.
No product ranges from the sources yet.
eog --version, and compare it against the fixed version once a source states one.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the application to read past the allocated buffer. This issue can lead to an application crash, resulting in a Denial of Service (DoS), or potentially expose sensitive memory contents.
This page as .md · .json · in your agent: get_signal("CVE-2026-118475")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.