# CVE-2026-107651: Eye of GNOME heap-based buffer overflow in PNG metadata reader

Source: https://junglewise.ai/threats/cve-2026-107651-a-flaw-was-found-in-eye-of-gnome-eog-a-heap-based-buffer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107651 · Severity: medium · CVSS 5.5 · Published 2026-10-08

Eye of GNOME (eog) is a desktop image viewer for Linux. A heap buffer overflow flaw in its PNG metadata parser can be triggered when a user opens a specially crafted PNG file, leading to application crash or potentially arbitrary code execution. An attacker must trick a user into opening a malicious image file to exploit this vulnerability.

Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome).

## Quick answers

**Is CVE-2026-107651 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107651 being exploited in the wild.

**How severe is CVE-2026-107651?** Medium severity, with a CVSS score of 5.5, published 8 October 2026.

**Which products and versions are affected?** GNOME Eye of GNOME.

**Is there a fix for CVE-2026-107651?** No fixed version is recorded yet. No mitigation is available; users must upgrade to a patched version once released. Server deployments without graphical desktop environments are not exposed to this flaw. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-107651 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-107651?** Check whether you run Gnome Eye of GNOME. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


No mitigation is available; users must upgrade to a patched version once released. Server deployments without graphical desktop environments are not exposed to this flaw.

## Technical details

A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata chunks (CWE-122). The vulnerability requires user interaction to open a malicious PNG file and is triggered through local parsing of untrusted image data. Confirmed impact is denial of service via application crash; code execution is theoretically possible but unconfirmed.

## Affected products

- GNOME Eye of GNOME

## Timeline

- 2026-10-08: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-107651](https://access.redhat.com/security/cve/CVE-2026-107651)