Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunk

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the application to read past the allocated buffer. This issue can lead to an application crash, resulting in a Denial of Service (DoS), or potentially expose sensitive memory contents.

Etkilenen sürümler4 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• bugzilla.redhat.com/show_bug.cgi Üçüncü taraf
• access.redhat.com/security/cve/CVE-2026-118475 Diğer
• gitlab.gnome.org/…ommit/04e4f313421eacb9fc529781542bb7fb81a3cd1a Diğer

Kayıt geçmişi

1. 30 Eki 2026 04:24Yayımlandı

İlgili açıklar

• 7,8 CVE-2026-119528Gimp: gimp: stack buffer overflow in psd image resource header loader
• 3,7 CVE-2026-115456Gcc: out-of-bounds read in std::from_chars
• 6,5 CVE-2026-115455Gcc: stack overflow in std::bitset on libstdc++
• 5,9 CVE-2026-114691Gcc: integer wrap in `std
• 6,2 CVE-2026-114690Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std
• 5,9 CVE-2026-118593Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)