CVE-2026-27631

The record

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught exception was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. Due to an integer overflow, the code attempts to create a huge std::vector, which causes Exiv2 to crash with an uncaught exception. This issue has been patched in version 0.28.8.

Affected packages

Related vulnerabilities

• CVE-2026-27596 Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif… Also affects exiv2
• CVE-2026-25884 Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif… Also affects exiv2
• CVE-2017-11591 There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that… Also affects exiv2
• CVE-2026-100347 kin-openapi is a Go project for handling OpenAPI files. CWE-248
• CVE-2026-102599 Socket.IO enables bidirectional and low-latency communication for every platform. CWE-248
• CVE-2026-107382 MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB… CWE-248
• CVE-2026-106122 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and… CWE-248
• CVE-2026-105757 vLLM is an inference and serving engine for large language models. CWE-248