Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. Summary: Possible buffer overrun when parsing malicious PNG files with non-standard iCCP chunk Requirements to exploit: A manipulated PNG file with a iCCP chunk that doesn't follow the PNG specification Component affected: Eye of GNOME (eog) Version affected: 2.23.1 <= eog <= 50.3 Patch available: Yes, https://gitlab.gnome.org/GNOME/eog/-/commit/04e4f313421eacb9fc529781542bb7fb81a3cd1a Version fixed (if any already): 50.4 Upstream coordination: See issue report (below) CVSS (optional): Impact (optional): Embargo: No Acknowledgment: PoC script by Ege BALCI Steps to reproduce if available: see issue report Mitigation if available: None Original report: See https://gitlab.gnome.org/GNOME/eog/-/issues/342#note_2903549 This was noticed while verifiying the fix for CVE-2026-107651. The PoC script accompanying that CVE produces PNG files which don't start their iCCP chunks with a NULL-terminated profile name, as mandated by the PNG specification. Intead the chunk us only filled with 'A'. Once Eye of GNOME loads one of these files it will try to extract the ICC profile from the PNG files. For that it calls eog_metadata_reader_png_get_icc_profile() the code tries to skip over the profile name, by walking over the chunk data looking for the first NULL byte. Since it doesn't keep track of the chunk's size it will eventually read past the allocated chunk data. This is so far only reproducible in ASan enabled builds, in normal builds it seems to "find" a NULL-byte directly after the chunk data. The issue was fixed already in release 50.4 using the patch linked above
This was handled by the fix for CVE-2026-107651 (rhbz#2547999) rawhide is already shipping 50.4, f45 has it in testing already, and f44/f43 already include the fix for this in the patch for CVE-2026-107651 Nothing left to do. Closing