CVE-2026-27631

LOW EPSS 16.7%
Published Mar 2, 20264mo ago · Modified Jun 17, 20262w ago
2.7 CVSS 4.0
Low
Find Similar
Published Mar 2, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago

Description

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught exception was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. Due to an integer overflow, the code attempts to create a huge std::vector, which causes Exiv2 to crash with an uncaught exception. This issue has been patched in version 0.28.8.

CVSS Details

Base Score
2.7
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
16.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-248

Affected Products 1

VendorProductVersionRange
exiv2exiv2* ≤0.28.8

References 4

  • github.com https://github.com/Exiv2/exiv2/commit/659db316eef745899a778a1e0b760a971d1b69df
    Patch
  • github.com https://github.com/Exiv2/exiv2/issues/3513
    Issue Tracking
  • github.com https://github.com/Exiv2/exiv2/pull/3514
    Issue TrackingPatch
  • github.com https://github.com/Exiv2/exiv2/security/advisories/GHSA-p2pw-7935-c73j
    PatchVendor Advisory

Remediation

  • github.com https://github.com/Exiv2/exiv2/commit/659db316eef745899a778a1e0b760a971d1b69df
    Patch
  • github.com https://github.com/Exiv2/exiv2/pull/3514
    Issue TrackingPatch
  • github.com https://github.com/Exiv2/exiv2/security/advisories/GHSA-p2pw-7935-c73j
    PatchVendor Advisory