CVE-2026-27596

Katalog CVE

CVSS 7.5 · High EPSS 0,64%

Kerentanan Out-of-bounds Read pada exiv2. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. The out-of-bounds read is at a 4GB offset, which usually causes Exiv2 to crash. This issue has been patched in version 0.28.8.

Rincian

Terbit di NVD

2 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read
CWE-191: Integer Underflow (Wrap or Wraparound)

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Exiv2/exiv2/security/advisories/GHSA-3wgv-fg4w-75x7 patch · advisory vendor
• https://github.com/Exiv2/exiv2/commit/eaa9e21aabe06b3f91cfe66686f5ebc3ca3c0ed4 patch
• https://github.com/Exiv2/exiv2/issues/3511 issue tracking
• https://github.com/Exiv2/exiv2/pull/3512 issue tracking