Bug 2562716 (CVE-2026-118475)

Summary: CVE-2026-118475 eog: Eye Of Gnome: buffer overrun when parsing malicious PNG files with non-standard iCCP chunk
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the application to read past the allocated buffer. This issue can lead to an application crash, resulting in a Denial of Service (DoS), or potentially expose sensitive memory contents.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-28 10:55:26 UTC 
Summary: Possible buffer overrun when parsing malicious PNG files with
non-standard iCCP chunk
Requirements to exploit: A manipulated PNG file with a iCCP chunk that
doesn't follow the PNG specification
Component affected: Eye of GNOME (eog)
Version affected: 2.23.1 <= eog <= 50.3
Patch available: Yes,
https://gitlab.gnome.org/GNOME/eog/-/commit/04e4f313421eacb9fc529781542bb7fb81a3cd1a
Version fixed (if any already): 50.4
Upstream coordination: See issue report (below)
CVSS (optional):
Impact (optional):
Embargo: No
Acknowledgment: PoC script by Ege BALCI
Steps to reproduce if available: see issue report
Mitigation if available: None
Original report:

See https://gitlab.gnome.org/GNOME/eog/-/issues/342#note_2903549

This was noticed while verifiying the fix for CVE-2026-107651. The PoC
script accompanying that CVE produces PNG files which don't start their
iCCP chunks with a NULL-terminated profile name, as mandated by the PNG
specification. Intead the chunk us only filled with 'A'.

Once Eye of GNOME loads one of these files it will try to extract the
ICC profile from the PNG files. For that it calls
eog_metadata_reader_png_get_icc_profile() the code tries to skip over
the profile name, by walking over the chunk data looking for the first
NULL byte. Since it doesn't keep  track of the chunk's size it will
eventually read past the allocated chunk data.

This is so far only reproducible in ASan enabled builds, in normal
builds it seems to "find" a NULL-byte directly after the chunk data.

The issue was fixed already in release 50.4 using the patch linked
above