CVE-2016-6855
Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4,...
CVE-2016-6855 is a high vulnerability (CVSS 7.5) in Gnome Eye Of Gnome, published August 23, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 18.4%, the 97th percentile. Fixed in eog 3.20.4-1.
Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service (out-of-bounds write and crash) via vectors involving passing invalid UTF-8 to GMarkup.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service (out-of-bounds write and crash) via vectors involving passing invalid UTF-8 to GMarkup.
- Record
CVE-2016-6855- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service (out-of-bounds write and crash) via vectors involving passing invalid UTF-8 to GMarkup.
- Record
CVE-2016-6855- Updated
- 2026-11-02
EUVDEUVD-2016-7740 No score
Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service (out-of-bounds write and crash) via vectors involving passing invalid UTF-8 to GMarkup.
- Record
EUVD-2016-7740- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7jwp-58q4-9rxh
Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4,...
Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service (out-of-bounds write and crash) via vectors involving passing invalid UTF-8 to GMarkup.
- Record
GHSA-7jwp-58q4-9rxh- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service (out-of-bounds write and crash) via vectors involving passing invalid UTF-8 to GMarkup.
- Record
CVE-2016-6855- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-6855
Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service (out-of-bounds write and crash) via vectors involving passing invalid UTF-8 to GMarkup.
- Record
DEBIAN-CVE-2016-6855- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2016-6855
Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service (out-of-bounds write and crash) via vectors involving passing invalid UTF-8 to GMarkup.
- Record
UBUNTU-CVE-2016-6855- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0297 No score
Updated eog packages fix security vulnerability
An out-of-bounds write vulnerability in eog was found when processing specially crafted SVG file. Due to passing the error message containing invalid UTF-8 character to GMarkup, out-of-bounds access is triggered (CVE-2016-6855).
- Record
MGASA-2016-0297- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10170-1 No score
eog-3.20.5-1.1 on GA media
These are all security issues fixed in the eog-3.20.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10170-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:2827-1 No score
Security update for eog
This update for eog fixes the following issues:
- out-of-bounds write in eog (bsc#994819, CVE-2016-6855)
- Record
SUSE-SU-2016:2827-1- Updated
- 2026-11-02
OSVUSN-3069-1 No score
eog vulnerability
It was discovered that Eye of GNOME incorrectly handled certain invalid UTF-8 strings. If a user were tricked into opening a specially-crafted image, a remote attacker could use this issue to cause Eye of GNOME to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-3069-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
eogDebian:12 |
before 3.20.4-1 | 3.20.4-1 |
eogDebian:13 |
before 3.20.4-1 | 3.20.4-1 |
eogDebian:14 |
before 3.20.4-1 | 3.20.4-1 |
eogDebian:8 |
before 3.14.1-1+deb8u1, plus listed versions 3.14.1-1 |
3.14.1-1+deb8u1 |
eogDebian:7 |
before 3.4.2-1+build1+deb7u1, plus listed versions 3.4.2-1+build1 |
3.4.2-1+build1+deb7u1 |
eogMageia:5 |
before 3.14.3-1.2.mga5 | 3.14.3-1.2.mga5 |
eogSUSE:Linux Enterprise Desktop 12 SP1 |
before 3.10.2-2.3.1 | 3.10.2-2.3.1 |
eogSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 3.10.2-2.3.1 | 3.10.2-2.3.1 |
eogSUSE:Linux Enterprise Server 12 SP1 |
before 3.10.2-2.3.1 | 3.10.2-2.3.1 |
eogSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 3.10.2-2.3.1 | 3.10.2-2.3.1 |
eogUbuntu:14.04:LTS |
before 3.10.2-0ubuntu5.2, plus listed versions 3.8.2-1ubuntu13.10.1-1ubuntu13.10.2-0ubuntu13.10.2-0ubuntu23.10.2-0ubuntu33.10.2-0ubuntu43.10.2-0ubuntu53.10.2-0ubuntu5.1 |
3.10.2-0ubuntu5.2 |
eogUbuntu:16.04:LTS |
before 3.18.2-1ubuntu2.1, plus listed versions 3.16.3-1ubuntu23.18.0-0ubuntu13.18.0-1ubuntu13.18.0-1ubuntu23.18.1-1ubuntu1 Show 4 moreShow less3.18.1-1ubuntu23.18.2-13.18.2-1ubuntu13.18.2-1ubuntu2 |
3.18.2-1ubuntu2.1 |
eogopenSUSE:Tumbleweed |
before 3.20.5-1.1 | 3.20.5-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Eye of Gnome 3.10.2 - GMarkup Out of Bounds Write | 2016-08-23 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
References
git.gnome.org/browse/eog/plain/NEWS?h=3.20.4
exploit-db.com/exploits/40291
securityfocus.com/bid/92616
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T6GFDHLNPUG7JHWM3QLXQNRA7NZGU2KI
Show 22 moreShow less
ubuntu.com/usn/USN-3069-1
lists.opensuse.org/opensuse-updates/2016-09/msg00021.html
bugzilla.gnome.org/show_bug.cgi?id=770143
packetstormsecurity.com/files/138486/Gnome-Eye-Of-Gnome-3.10.2-Out-Of-Bounds-Write.html
lists.debian.org/debian-lts-announce/2020/04/msg00018.html
nvd.nist.gov/vuln/detail/CVE-2016-6855
github.com/advisories/GHSA-7jwp-58q4-9rxh
security-tracker.debian.org/tracker/CVE-2016-6855
advisories.mageia.org/MGASA-2016-0297.html
bugs.mageia.org/show_bug.cgi?id=19244
suse.com/support/update/announcement/2016/suse-su-20162827-1
bugzilla.suse.com/994819
ubuntu.com/security/CVE-2016-6855
cve.org/CVERecord?id=CVE-2016-6855