Exiv2 command-line utility crashes reading certain image files

Summary

Exiv2's command-line utility is affected if you use it with an extra argument to display a preview. If you're using a version earlier than 0.28.8, it may crash when processing certain image files. Update to version 0.28.8 or later to fix the issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
canonical	exiv2	All versions	–
canonical	exiv2	All versions	–
canonical	exiv2	All versions	–
canonical	exiv2	All versions	–
canonical	exiv2	All versions	–
canonical	exiv2	All versions	–

Original title

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found in Exiv2. The vu...

Original description

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. The out-of-bounds read is at a 4GB offset, which usually causes Exiv2 to crash. This issue has been patched in version 0.28.8.

osv CVSS4.0 7.8

osv CVSS3.1 7.5

https://ubuntu.com/security/CVE-2026-27596 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-27596 Third Party Advisory
https://github.com/Exiv2/exiv2/security/advisories/GHSA-3wgv-fg4w-75x7 Third Party Advisory
https://github.com/Exiv2/exiv2/issues/3511 Third Party Advisory
https://github.com/Exiv2/exiv2/pull/3512 Third Party Advisory
https://github.com/Exiv2/exiv2/commit/eaa9e21aabe06b3f91cfe66686f5ebc3ca3c0ed4 Third Party Advisory