Skip to content
Heist/ feed
CriticalFix available

exiv2 security update

Type: advisorySource: OSV1 source record

Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats. Security Fix(es): Exiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275) Exiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546) Exiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource thro

Announced Source revision 1
Original source ↗

OESA-2026-4088

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:OESA-2026-4088

exiv2

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
0.28.2-10.oe2403sp4

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "0.28.2-10.oe2403sp4"
          }
        ]
      }
    ],
    "package": {
      "name": "exiv2",
      "purl": "pkg:rpm/openEuler/exiv2&distro=openEuler-24.03-LTS-SP4",
      "ecosystem": "openEuler:24.03-LTS-SP4"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4088.json"
    },
    "ecosystem_specific": {
      "src": [
        "exiv2-0.28.2-10.oe2403sp4.src.rpm"
      ],
      "noarch": [
        "exiv2-help-0.28.2-10.oe2403sp4.noarch.rpm"
      ],
      "x86_64": [
        "exiv2-0.28.2-10.oe2403sp4.x86_64.rpm",
        "exiv2-debuginfo-0.28.2-10.oe2403sp4.x86_64.rpm",
        "exiv2-debugsource-0.28.2-10.oe2403sp4.x86_64.rpm",
        "exiv2-devel-0.28.2-10.oe2403sp4.x86_64.rpm"
      ],
      "aarch64": [
        "exiv2-0.28.2-10.oe2403sp4.aarch64.rpm",
        "exiv2-debuginfo-0.28.2-10.oe2403sp4.aarch64.rpm",
        "exiv2-debugsource-0.28.2-10.oe2403sp4.aarch64.rpm",
        "exiv2-devel-0.28.2-10.oe2403sp4.aarch64.rpm"
      ]
    }
  }
]

Publisher severity

critical

Source reference: /database_specific/severity

Event
#14747 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement