CVE-2026-27596
High · 7.5CVSS
7.5
EPSS
0.7%
Published
Mar 2, 2026
CISA due date
—
The record
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. The out-of-bounds read is at a 4GB offset, which usually causes Exiv2 to crash. This issue has been patched in version 0.28.8.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | exiv2 | 0 | 0.28.8-160000.1.1 |
Related vulnerabilities
- CVE-2026-27631 Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif… Also affects exiv2
- CVE-2026-25884 Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif… Also affects exiv2
- CVE-2026-92824 A flaw was found in libmodulemd. CWE-125
- CVE-2026-114038 A flaw was found in device-mapper-multipath. CWE-125
- CVE-2026-112896 Pillow is a Python imaging library. CWE-125
- CVE-2026-112278 rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in… CWE-125
- CVE-2026-112273 libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name… CWE-125
- CVE-2026-112073 A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dc… CWE-125