CVE-2026-107651 is a buffer overflow vulnerability in the Eye of GNOME graphics viewer program, specifically in the eog package. No specific affected version range is stated, though the issue is associated with the stable distribution (trixie). The flaw occurs when the application processes a malformed PNG file, allowing memory corruption that could possibly result in the execution of arbitrary code. Exploitation requires an attacker to supply or cause the opening of a crafted PNG file by a user or automated process that invokes the viewer. The attack vector is therefore tied to file handling rather than network access, and the attacker does not need prior authentication beyond the ability to place or deliver the malicious file to a target environment. Successful exploitation could allow an attacker to run arbitrary code with the privileges of the user or service running the viewer, potentially leading to data theft, system compromise, unauthorized access, disruption of business processes, or further lateral movement within a network. Because the impact is possible arbitrary code execution, the vulnerability is significant for environments where users open untrusted image files or where the viewer is used in automated workflows.
We recommend you to upgrade eog packages to version 47.0-1+deb13u1 on Debian trixie.[/subscribe_to_unlock_form]
CVE-2026-107651 is a buffer overflow vulnerability in the Eye of GNOME graphics viewer program, specifically in the eog package. No specific affected version range is stated, though the issue is associated with the stable distribution (trixie). The flaw occurs when the application processes a malformed PNG file, allowing memory corruption that could possibly result in the execution of arbitrary code. Exploitation requires an attacker to supply or cause the opening of a crafted PNG file by a user or automated process that invokes the viewer. The attack vector is therefore tied to file handling rather than network access, and the attacker does not need prior authentication beyond the ability to place or deliver the malicious file to a target environment. Successful exploitation could allow an attacker to run arbitrary code with the privileges of the user or service running the viewer, potentially leading to data theft, system compromise, unauthorized access, disruption of business processes, or further lateral movement within a network. Because the impact is possible arbitrary code execution, the vulnerability is significant for environments where users open untrusted image files or where the viewer is used in automated workflows.
We recommend you to upgrade eog packages to version 47.0-1+deb13u1 on Debian trixie.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]