Eye of GNOME EUVD-2026-95401

Exploitation requires a local user to open an attacker-supplied, specially crafted PNG file in Eye of GNOME (eog); the trigger is the PNG metadata reader's improper state handling when parsing split metadata chunks. Limiting factors: mandatory user interaction (UI:R) - the file must be opened in eog; local vector (AV:L) with no network-facing exposure; and the affected software is a GNOME desktop image viewer, so only systems running the GNOME desktop with eog installed (RHEL 6-9 desktops per the CPE list) are exposed. Despite the description's 'remote attacker' wording, there is no unauthenticated network exploitation path - the attacker only delivers the file; a local user must open it.

This is a medium-severity issue (CVSS 5.5) whose real-world priority is constrained by its exploitation model rather than its impact. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) describes a local vector requiring user interaction, with the ONLY scored impact being availability (A:H) - i.e. the official Red Hat rating treats this as a Denial-of-Service crash, NOT code execution, despite the description stating it 'potentially' leads to arbitrary code execution. This is a notable conflict: the prose implies RCE (C/I/A compromise) while the authoritative CVSS metrics score C:N/I:N - verify the true impact with Red Hat before treating this as an RCE. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of local attack vector, mandatory user interaction (opening a malicious file), and desktop-only footprint makes this a lower-urgency patch item than a network-facing unauthenticated flaw of the same score. Note also that the description's phrase 'remote attacker' refers to an attacker who crafts and delivers the malicious PNG; the CVSS vector is correctly AV:L because successful exploitation requires a local user to open that file in eog.

An attacker crafts a malicious PNG with split/malformed metadata chunks and delivers it to a victim (e.g. via email, chat, website, or a shared file). When the victim opens the image in Eye of GNOME, the PNG metadata reader mishandles the chunk state and triggers a heap-based buffer overflow, crashing the viewer (confirmed DoS) and potentially allowing code execution in the user's context (claimed in description, not reflected in the CVSS impact metrics). No public exploit code is identified at time of analysis.