Vulnerability-Lookup

oesa-2026-1564

Vulnerability from osv_openeuler

Published

2026-03-15 11:10

Modified

2026-08-06 11:10

Summary

exiv2 security update

Details

Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.

Security Fix(es):

An out-of-bounds read was found in Exiv2 version v0.28.7. The vulnerability is in the CRW image parser. The bug is reproducible with our fuzz target, but we have not been able to reproduce it with the exiv2 command line application. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted video file.(CVE-2026-25884)

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. The out-of-bounds read is at a 4GB offset, which usually causes Exiv2 to crash. This issue has been patched in version 0.28.8.(CVE-2026-27596)

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught exception was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. Due to an integer overflow, the code attempts to create a huge std::vector, which causes Exiv2 to crash with an uncaught exception. This issue has been patched in version 0.28.8.(CVE-2026-27631)

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-25884	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-27596	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-27631	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "exiv2-0.28.2-8.oe2403sp2.aarch64.rpm",
          "exiv2-debuginfo-0.28.2-8.oe2403sp2.aarch64.rpm",
          "exiv2-debugsource-0.28.2-8.oe2403sp2.aarch64.rpm",
          "exiv2-devel-0.28.2-8.oe2403sp2.aarch64.rpm"
        ],
        "noarch": [
          "exiv2-help-0.28.2-8.oe2403sp2.noarch.rpm"
        ],
        "src": [
          "exiv2-0.28.2-8.oe2403sp2.src.rpm"
        ],
        "x86_64": [
          "exiv2-0.28.2-8.oe2403sp2.x86_64.rpm",
          "exiv2-debuginfo-0.28.2-8.oe2403sp2.x86_64.rpm",
          "exiv2-debugsource-0.28.2-8.oe2403sp2.x86_64.rpm",
          "exiv2-devel-0.28.2-8.oe2403sp2.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP2",
        "name": "exiv2",
        "purl": "pkg:rpm/openEuler/exiv2\u0026distro=openEuler-24.03-LTS-SP2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.28.2-8.oe2403sp2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "exiv2-0.28.2-8.oe2403sp3.aarch64.rpm",
          "exiv2-debuginfo-0.28.2-8.oe2403sp3.aarch64.rpm",
          "exiv2-debugsource-0.28.2-8.oe2403sp3.aarch64.rpm",
          "exiv2-devel-0.28.2-8.oe2403sp3.aarch64.rpm"
        ],
        "noarch": [
          "exiv2-help-0.28.2-8.oe2403sp3.noarch.rpm"
        ],
        "src": [
          "exiv2-0.28.2-8.oe2403sp3.src.rpm"
        ],
        "x86_64": [
          "exiv2-0.28.2-8.oe2403sp3.x86_64.rpm",
          "exiv2-debuginfo-0.28.2-8.oe2403sp3.x86_64.rpm",
          "exiv2-debugsource-0.28.2-8.oe2403sp3.x86_64.rpm",
          "exiv2-devel-0.28.2-8.oe2403sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "exiv2",
        "purl": "pkg:rpm/openEuler/exiv2\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.28.2-8.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "exiv2-0.27.5-7.oe2003sp4.aarch64.rpm",
          "exiv2-debuginfo-0.27.5-7.oe2003sp4.aarch64.rpm",
          "exiv2-debugsource-0.27.5-7.oe2003sp4.aarch64.rpm",
          "exiv2-devel-0.27.5-7.oe2003sp4.aarch64.rpm"
        ],
        "noarch": [
          "exiv2-help-0.27.5-7.oe2003sp4.noarch.rpm"
        ],
        "src": [
          "exiv2-0.27.5-7.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "exiv2-0.27.5-7.oe2003sp4.x86_64.rpm",
          "exiv2-debuginfo-0.27.5-7.oe2003sp4.x86_64.rpm",
          "exiv2-debugsource-0.27.5-7.oe2003sp4.x86_64.rpm",
          "exiv2-devel-0.27.5-7.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "exiv2",
        "purl": "pkg:rpm/openEuler/exiv2\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.27.5-7.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "exiv2-0.27.5-7.oe2203sp4.aarch64.rpm",
          "exiv2-debuginfo-0.27.5-7.oe2203sp4.aarch64.rpm",
          "exiv2-debugsource-0.27.5-7.oe2203sp4.aarch64.rpm",
          "exiv2-devel-0.27.5-7.oe2203sp4.aarch64.rpm"
        ],
        "noarch": [
          "exiv2-help-0.27.5-7.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "exiv2-0.27.5-7.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "exiv2-0.27.5-7.oe2203sp4.x86_64.rpm",
          "exiv2-debuginfo-0.27.5-7.oe2203sp4.x86_64.rpm",
          "exiv2-debugsource-0.27.5-7.oe2203sp4.x86_64.rpm",
          "exiv2-devel-0.27.5-7.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "exiv2",
        "purl": "pkg:rpm/openEuler/exiv2\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.27.5-7.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "exiv2-0.28.2-8.oe2403sp2.aarch64.rpm",
          "exiv2-debuginfo-0.28.2-8.oe2403sp2.aarch64.rpm",
          "exiv2-debugsource-0.28.2-8.oe2403sp2.aarch64.rpm",
          "exiv2-devel-0.28.2-8.oe2403sp2.aarch64.rpm",
          "exiv2-0.28.2-8.oe2403sp3.aarch64.rpm",
          "exiv2-debuginfo-0.28.2-8.oe2403sp3.aarch64.rpm",
          "exiv2-debugsource-0.28.2-8.oe2403sp3.aarch64.rpm",
          "exiv2-devel-0.28.2-8.oe2403sp3.aarch64.rpm",
          "exiv2-0.28.2-8.oe2403.aarch64.rpm",
          "exiv2-debuginfo-0.28.2-8.oe2403.aarch64.rpm",
          "exiv2-debugsource-0.28.2-8.oe2403.aarch64.rpm",
          "exiv2-devel-0.28.2-8.oe2403.aarch64.rpm",
          "exiv2-0.28.2-8.oe2403sp1.aarch64.rpm",
          "exiv2-debuginfo-0.28.2-8.oe2403sp1.aarch64.rpm",
          "exiv2-debugsource-0.28.2-8.oe2403sp1.aarch64.rpm",
          "exiv2-devel-0.28.2-8.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "exiv2-help-0.28.2-8.oe2403sp2.noarch.rpm",
          "exiv2-help-0.28.2-8.oe2403sp3.noarch.rpm",
          "exiv2-help-0.28.2-8.oe2403.noarch.rpm",
          "exiv2-help-0.28.2-8.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "exiv2-0.28.2-8.oe2403sp2.src.rpm",
          "exiv2-0.28.2-8.oe2403sp3.src.rpm",
          "exiv2-0.28.2-8.oe2403.src.rpm",
          "exiv2-0.28.2-8.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "exiv2-0.28.2-8.oe2403sp2.x86_64.rpm",
          "exiv2-debuginfo-0.28.2-8.oe2403sp2.x86_64.rpm",
          "exiv2-debugsource-0.28.2-8.oe2403sp2.x86_64.rpm",
          "exiv2-devel-0.28.2-8.oe2403sp2.x86_64.rpm",
          "exiv2-0.28.2-8.oe2403sp3.x86_64.rpm",
          "exiv2-debuginfo-0.28.2-8.oe2403sp3.x86_64.rpm",
          "exiv2-debugsource-0.28.2-8.oe2403sp3.x86_64.rpm",
          "exiv2-devel-0.28.2-8.oe2403sp3.x86_64.rpm",
          "exiv2-0.28.2-8.oe2403.x86_64.rpm",
          "exiv2-debuginfo-0.28.2-8.oe2403.x86_64.rpm",
          "exiv2-debugsource-0.28.2-8.oe2403.x86_64.rpm",
          "exiv2-devel-0.28.2-8.oe2403.x86_64.rpm",
          "exiv2-0.28.2-8.oe2403sp1.x86_64.rpm",
          "exiv2-debuginfo-0.28.2-8.oe2403sp1.x86_64.rpm",
          "exiv2-debugsource-0.28.2-8.oe2403sp1.x86_64.rpm",
          "exiv2-devel-0.28.2-8.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "exiv2",
        "purl": "pkg:rpm/openEuler/exiv2\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.28.2-8.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "exiv2-0.28.2-8.oe2403sp1.aarch64.rpm",
          "exiv2-debuginfo-0.28.2-8.oe2403sp1.aarch64.rpm",
          "exiv2-debugsource-0.28.2-8.oe2403sp1.aarch64.rpm",
          "exiv2-devel-0.28.2-8.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "exiv2-help-0.28.2-8.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "exiv2-0.28.2-8.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "exiv2-0.28.2-8.oe2403sp1.x86_64.rpm",
          "exiv2-debuginfo-0.28.2-8.oe2403sp1.x86_64.rpm",
          "exiv2-debugsource-0.28.2-8.oe2403sp1.x86_64.rpm",
          "exiv2-devel-0.28.2-8.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "exiv2",
        "purl": "pkg:rpm/openEuler/exiv2\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.28.2-8.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.\r\n\r\nSecurity Fix(es):\n\nAn out-of-bounds read was found in Exiv2 version v0.28.7. The vulnerability is in the CRW image parser. The bug is reproducible with our fuzz target, but we have not been able to reproduce it with the exiv2 command line application. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted video file.(CVE-2026-25884)\n\nExiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. The out-of-bounds read is at a 4GB offset, which usually causes Exiv2 to crash. This issue has been patched in version 0.28.8.(CVE-2026-27596)\n\nExiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught exception was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. Due to an integer overflow, the code attempts to create a huge std::vector, which causes Exiv2 to crash with an uncaught exception. This issue has been patched in version 0.28.8.(CVE-2026-27631)",
  "id": "OESA-2026-1564",
  "modified": "2026-08-06T11:10:34Z",
  "published": "2026-03-15T11:10:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1564"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25884"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27596"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27631"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "exiv2 security update",
  "upstream": [
    "CVE-2026-25884",
    "CVE-2026-27596",
    "CVE-2026-27631"
  ]
}

CVE-2026-25884 (GCVE-0-2026-25884)

Vulnerability from cvelistv5 – Published: 2026-03-02 19:41 – Updated: 2026-03-02 20:15

Title

Exiv2: Out-of-bounds read in CrwMap::decode0x0805

Summary

Severity

2.7 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-02 20:15 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/Exiv2/exiv2/security/advisorie…	x_refsource_CONFIRM
https://github.com/Exiv2/exiv2/pull/3462	x_refsource_MISC
https://github.com/Exiv2/exiv2/commit/cbba4d20651…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Exiv2	exiv2	Affected: < 0.28.8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25884",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-02T20:15:01.199664Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-02T20:15:22.706Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "exiv2",
          "vendor": "Exiv2",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.28.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found. The vulnerability is in the CRW image parser. This issue has been patched in version 0.28.8."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-02T19:41:21.157Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Exiv2/exiv2/security/advisories/GHSA-9mxq-4j5g-5wrp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Exiv2/exiv2/security/advisories/GHSA-9mxq-4j5g-5wrp"
        },
        {
          "name": "https://github.com/Exiv2/exiv2/pull/3462",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Exiv2/exiv2/pull/3462"
        },
        {
          "name": "https://github.com/Exiv2/exiv2/commit/cbba4d206512fe63e12d164fdd1881562f072a9d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Exiv2/exiv2/commit/cbba4d206512fe63e12d164fdd1881562f072a9d"
        }
      ],
      "source": {
        "advisory": "GHSA-9mxq-4j5g-5wrp",
        "discovery": "UNKNOWN"
      },
      "title": "Exiv2: Out-of-bounds read in CrwMap::decode0x0805"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25884",
    "datePublished": "2026-03-02T19:41:21.157Z",
    "dateReserved": "2026-02-06T21:08:39.129Z",
    "dateUpdated": "2026-03-02T20:15:22.706Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27596 (GCVE-0-2026-27596)

Vulnerability from cvelistv5 – Published: 2026-03-02 19:40 – Updated: 2026-03-02 20:25

Title

Exiv2: Integer Underflow in LoaderNative::getData() Causes Heap Buffer Overflow

Summary

Severity

2.7 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-02 20:25 UTC

CWE

CWE-125 - Out-of-bounds Read
CWE-191 - Integer Underflow (Wrap or Wraparound)

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/Exiv2/exiv2/security/advisorie…	x_refsource_CONFIRM
https://github.com/Exiv2/exiv2/issues/3511	x_refsource_MISC
https://github.com/Exiv2/exiv2/pull/3512	x_refsource_MISC
https://github.com/Exiv2/exiv2/commit/eaa9e21aabe…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Exiv2	exiv2	Affected: < 0.28.8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-27596",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-02T20:25:12.745500Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-02T20:25:31.790Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "exiv2",
          "vendor": "Exiv2",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.28.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. The out-of-bounds read is at a 4GB offset, which usually causes Exiv2 to crash. This issue has been patched in version 0.28.8."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-191",
              "description": "CWE-191: Integer Underflow (Wrap or Wraparound)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-02T19:40:48.559Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Exiv2/exiv2/security/advisories/GHSA-3wgv-fg4w-75x7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Exiv2/exiv2/security/advisories/GHSA-3wgv-fg4w-75x7"
        },
        {
          "name": "https://github.com/Exiv2/exiv2/issues/3511",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Exiv2/exiv2/issues/3511"
        },
        {
          "name": "https://github.com/Exiv2/exiv2/pull/3512",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Exiv2/exiv2/pull/3512"
        },
        {
          "name": "https://github.com/Exiv2/exiv2/commit/eaa9e21aabe06b3f91cfe66686f5ebc3ca3c0ed4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Exiv2/exiv2/commit/eaa9e21aabe06b3f91cfe66686f5ebc3ca3c0ed4"
        }
      ],
      "source": {
        "advisory": "GHSA-3wgv-fg4w-75x7",
        "discovery": "UNKNOWN"
      },
      "title": "Exiv2: Integer Underflow in LoaderNative::getData() Causes Heap Buffer Overflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-27596",
    "datePublished": "2026-03-02T19:40:48.559Z",
    "dateReserved": "2026-02-20T19:43:14.601Z",
    "dateUpdated": "2026-03-02T20:25:31.790Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-27631 (GCVE-0-2026-27631)

Vulnerability from cvelistv5 – Published: 2026-03-02 19:40 – Updated: 2026-03-02 20:28

Title

Exiv2: Uncaught exception - cannot create std::vector larger than max_size()

Summary

Severity

2.7 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-02 20:27 UTC

CWE

CWE-248 - Uncaught Exception

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/Exiv2/exiv2/security/advisorie…	x_refsource_CONFIRM
https://github.com/Exiv2/exiv2/issues/3513	x_refsource_MISC
https://github.com/Exiv2/exiv2/pull/3514	x_refsource_MISC
https://github.com/Exiv2/exiv2/commit/659db316eef…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Exiv2	exiv2	Affected: < 0.28.8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-27631",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-02T20:27:04.449308Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-02T20:28:01.516Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "exiv2",
          "vendor": "Exiv2",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.28.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught exception was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. Due to an integer overflow, the code attempts to create a huge std::vector, which causes Exiv2 to crash with an uncaught exception. This issue has been patched in version 0.28.8."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-02T19:40:45.351Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Exiv2/exiv2/security/advisories/GHSA-p2pw-7935-c73j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Exiv2/exiv2/security/advisories/GHSA-p2pw-7935-c73j"
        },
        {
          "name": "https://github.com/Exiv2/exiv2/issues/3513",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Exiv2/exiv2/issues/3513"
        },
        {
          "name": "https://github.com/Exiv2/exiv2/pull/3514",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Exiv2/exiv2/pull/3514"
        },
        {
          "name": "https://github.com/Exiv2/exiv2/commit/659db316eef745899a778a1e0b760a971d1b69df",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Exiv2/exiv2/commit/659db316eef745899a778a1e0b760a971d1b69df"
        }
      ],
      "source": {
        "advisory": "GHSA-p2pw-7935-c73j",
        "discovery": "UNKNOWN"
      },
      "title": "Exiv2: Uncaught exception - cannot create std::vector larger than max_size()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-27631",
    "datePublished": "2026-03-02T19:40:45.351Z",
    "dateReserved": "2026-02-20T22:02:30.028Z",
    "dateUpdated": "2026-03-02T20:28:01.516Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

oesa-2026-1564

Vulnerability from osv_openeuler

CVE-2026-25884 (GCVE-0-2026-25884)

CVE-2026-27596 (GCVE-0-2026-27596)

CVE-2026-27631 (GCVE-0-2026-27631)

Tags

Sightings

Nomenclature

Related by attack behaviour