Bug 2547999

Summary:	CVE-2026-107651 eog: eog: arbitrary code execution via heap buffer overflow in PNG metadata reader [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Thibault Guittet <tguittet>
Component:	eog	Assignee:	Adrian Vovk <avovk>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	avovk, gnome-sig, kalevlember, mclasen, rstrode, sipoyare
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["b255d7dd-243d-448c-8489-c5301fcb3344"]}
Fixed In Version:	eog-49.3-2.fc43	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-28 02:47:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2547986

Description Thibault Guittet 2026-10-08 14:37:40 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A heap buffer overflow vulnerability was found in Eye of GNOME (eog) in the PNG metadata reader component (eog-metadata-reader-png). The flaw exists in the handling of cHRM and gAMA chunk resume state during PNG file parsing. An attacker could exploit this by crafting a malicious PNG file that, when opened by a victim, triggers the overflow, potentially leading to arbitrary code execution or a denial of service.

Upstream issue: https://gitlab.gnome.org/GNOME/eog/-/issues/342

Comment 1 Adrian Vovk 2026-10-23 03:17:19 UTC

Vulnerability has been fixed upstream in the 50.4 release, which we already ship in f44, f45, and rawhide

However, it appears that f43 is still vulnerable. We need to backport:

- https://gitlab.gnome.org/GNOME/eog/-/commit/769e4309ae6976248d8c5debe0ff85ff167ed705
- https://gitlab.gnome.org/GNOME/eog/-/commit/04e4f313421eacb9fc529781542bb7fb81a3cd1a

Comment 2 Fedora Update System 2026-10-23 22:33:19 UTC

FEDORA-2026-c84199fbcd (eog-49.3-2.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-c84199fbcd

Comment 3 Fedora Update System 2026-10-24 17:48:37 UTC

FEDORA-2026-c84199fbcd has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-c84199fbcd`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-c84199fbcd

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 4 Fedora Update System 2026-10-28 02:47:55 UTC

FEDORA-2026-c84199fbcd (eog-49.3-2.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.