Hi,

The following vulnerability was published for eog.

CVE-2026-107651[0]:
| A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow
| exists in the PNG metadata reader due to improper state handling
| when parsing split metadata chunks. A remote attacker could exploit
| this flaw by enticing a user into opening a specially crafted PNG
| file, potentially leading to arbitrary code execution or a Denial of
| Service (DoS) via application crash.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-107651
https://www.cve.org/CVERecord?id=CVE-2026-107651
[1] https://gitlab.gnome.org/GNOME/eog/-/issues/342

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hello,

Bug #1150455 in eog reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/gnome-team/extras/eog/-/commit/0a029adbeff52345799e74153a4679e206fb4d57
------------------------------------------------------------------------
New upstream release

Closes: #1150455
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1150455

We believe that the bug you reported is fixed in the latest version of
eog, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150455@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jeremy Bícha <jbicha@ubuntu.com> (supplier of updated eog package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 19 Oct 2026 11:15:22 +0200
Source: eog
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 50.4-1
Distribution: unstable
Urgency: high
Maintainer: Debian GNOME Extras Maintainers <pkg-gnome-extras-maintainers@lists.alioth.debian.org>
Changed-By: Jeremy Bícha <jbicha@ubuntu.com>
Closes: 1150455
Changes:
 eog (50.4-1) unstable; urgency=high
 .
   * New upstream release
     - Fix heap buffer overflow in png metadata reader (CVE-2026-107651)
       (Closes: #1150455)
Checksums-Sha1:
 6e94aaf258151cdbc8ecf96481ac01a0010b6d92 2471 eog_50.4-1.dsc
 f836f7f7d7d959856def7ea376779f8b5a47e420 4736268 eog_50.4.orig.tar.xz
 cacf4a1450f30c3f3b5ad190da87f1cd01666569 16380 eog_50.4-1.debian.tar.xz
 e180e1837e813f593dbee8d683146e24640fe189 8639 eog_50.4-1_source.buildinfo
Checksums-Sha256:
 bc6150ba13360112e6daec32b9fe67dd389e8242767a4b17431b6ee83025dc04 2471 eog_50.4-1.dsc
 db9a11ebad2fb1e5199c529d0eab8e566bd2d5138585ac467e5f6752206486c9 4736268 eog_50.4.orig.tar.xz
 8983a7845d5ba0d59022673b68447ad20ee1f0a5054c5c918ac4f6a0a435a44e 16380 eog_50.4-1.debian.tar.xz
 234ee00b3b7d5070d01929ac469d6813166f5df1d07c3b29e9102a52369e4656 8639 eog_50.4-1_source.buildinfo
Files:
 d9510651cb1fba679b43f6fae5c34dd2 2471 gnome optional eog_50.4-1.dsc
 2d790d70052ff8aa0a5f04b130fe15e3 4736268 gnome optional eog_50.4.orig.tar.xz
 bf0bcc403232859d93b0c9b881ca8390 16380 gnome optional eog_50.4-1.debian.tar.xz
 5927390755a7acd5745be2781bbb6849 8639 gnome optional eog_50.4-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmrV38EACgkQ5mx3Wuv+
bH2dSQ/5ATxEgOJoLrIc2A4eZMOsFP7HjCUbEOLkADnbGYCfRBRCdqA5pMIEPqhW
ANftbCoOEqLR3Im3SpbnftCKD/8VwhTZO70Zv+3A8nmAtRJLNx/bEucR10Zah7aG
8ZSCZEqNpzAd0FZMfreBy8kLTd7iFrdF1fBKOPutIgHYTnM1+56qHLFixw7HA+rb
6MEzOe060+Zv6+vfxqr2pumGrtgiWI+kx/FwQuEb5fRXRy8J4XmB+mzhT5cmhXp3
1JyUaUz2S8QPb44sjzwT7zI6ls2XxOrpKEieyTC8mSTUIuJsnjVDp5mVrUbFeuUo
+LhwhfTivoOMmacvORdTrnjbzRiJKXNYraW3yuVkag8tcAk6qImVTWpOuzCTU22s
L6LomFWRx9+hWf+y1/xSaPwI3ZcXu0zPc2m4j00dgUR4HS/eQfueqdoqo42PaGf7
7Z7opxo4KnNSCs+IkIpDiLow0heKoaI6SkCa/YZjPRN4a3WMXopeBktJuT+MeABW
ROUra6v2jUt2+EqeGX0WIJk8qQsp9M/Ek5dPSEZVwLZeBbFny6kLDxgYSDT+oFYl
PA8rAh+D9jPwlSs8FnPfbobgioV+Pl++TZp7Fx0CNQ5GV+vXnYLzUhmqZkCjv0Or
y0W1DfD7zjcck1HDWwVqSF7JDE8qsLYChB6YXLsPrgME+dQCErA=
=XP5p
-----END PGP SIGNATURE-----