Eye of GNOME EUVD-2026-113476

Exploitation requires that Eye of GNOME (eog) be installed and that a user be tricked into opening an attacker-supplied PNG file whose color-profile (ICC) metadata is malformed so that the null-terminator search runs past the chunk boundary. Limiting factors: the vector is local (AV:L) and requires user interaction (UI:R) - there is no remote or unauthenticated network trigger; the issue only affects desktop/workstation deployments where the GNOME image viewer is present, so headless servers are unaffected; and the realistic impact is a crash (DoS) with only limited potential memory disclosure (C:L), not code execution or data modification (I:N). No non-default configuration is required beyond having eog installed and the user opening the file.

This is a genuinely low-priority issue, and the multiple signals agree rather than conflict. The CVSS 3.1 base score of 3.6 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L) describes a local, user-interaction-dependent out-of-bounds read (CWE-125) in Eye of GNOME with only limited confidentiality and availability impact and no integrity impact. The vuln.today decision label is 'monitor', the lowest urgency tier, consistent with the modest score. No EPSS score, CISA KEV listing, or SSVC decision framework was supplied in the input; absence of these is not itself an error but means there is no evidence of active exploitation or elevated exploitation probability. No public exploit identified at time of analysis - the only GNOME GitLab link is the upstream fix commit, not proof-of-concept or exploit code. One point worth verifying: the input CVSS marks AC:H, but the description characterizes a deterministic missing-bounds-check when searching for a null terminator in crafted color-profile metadata, which does not read like a high-complexity or race condition - the trigger mechanism beyond 'malformed color profile metadata' is not detailed in the available sources, so the AC:H rating is not clearly substantiated by the description. The realistic worst case is an application crash (DoS) with possible limited memory disclosure, not code execution.

An attacker crafts a PNG with malformed color-profile metadata whose chunk lacks a proper null terminator, then delivers it to a victim (email attachment, download, shared drive) and relies on the user opening it in Eye of GNOME. When eog parses the profile it reads past the allocated buffer, most likely crashing the viewer (DoS) and potentially exposing adjacent process memory. No public exploit or proof-of-concept was identified at time of analysis; only the upstream fix commit is referenced.