CVE-2026-27596
HIGHExiv2 <0.28.8 - Memory Corruption
Title source: llmDescription
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. The out-of-bounds read is at a 4GB offset, which usually causes Exiv2 to crash. This issue has been patched in version 0.28.8.
Scores
CVSS v3
7.5
EPSS
0.0006
EPSS Percentile
18.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-125
CWE-191
Status
published
Products (1)
exiv2/exiv2
< 0.28.8
Published
Mar 02, 2026
Tracked Since
Mar 03, 2026