Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-27596: Exiv2 preview option can cause crash

CVE-2026-27596 · published 8 months ago

Summary

Versions of Exiv2 before 0.28.8 may crash when the preview command (for example, using the -pp flag) is run. The crash happens because the program reads memory far beyond what it should, which can stop the tool from working. Upgrade to Exiv2 version 0.28.8 or later to fix the issue.

What to do

Update debian exiv2 to version 0.28.8+dfsg-1.
Update exiv2 exiv2 to version 0.28.8 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	exiv2	exiv2	< 0.28.8 `cpe:2.3:a:exiv2:exiv2::::::::`
Ubuntu:Pro:16.04:LTS	canonical	exiv2	All versions
Ubuntu:18.04:LTS	canonical	exiv2	All versions
Ubuntu:20.04:LTS	canonical	exiv2	All versions
Ubuntu:22.04:LTS	canonical	exiv2	All versions
Ubuntu:24.04:LTS	canonical	exiv2	All versions
Ubuntu:25.10	canonical	exiv2	All versions
Debian:11	debian	exiv2	All versions
Debian:12	debian	exiv2	All versions
Debian:13	debian	exiv2	All versions
Debian:14	debian	exiv2	< 0.28.8+dfsg-1 Fix: upgrade to 0.28.8+dfsg-1

Original advisory text

Exiv2: Integer Underflow in LoaderNative::getData() Causes Heap Buffer Overflow

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. The out-of-bounds read is at a 4GB offset, which usually causes Exiv2 to crash. This issue has been patched in version 0.28.8.

References

https://github.com/Exiv2/exiv2/security/advisories/GHSA-3wgv-fg4w-75x7 Vendor Advisory
https://github.com/Exiv2/exiv2/issues/3511 Third Party Advisory
https://github.com/Exiv2/exiv2/commit/eaa9e21aabe06b3f91cfe66686f5ebc3ca3c0ed4 Patch
https://ubuntu.com/security/CVE-2026-27596 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-27596 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-27596 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27596... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-27596 Vendor Advisory
https://github.com/Exiv2/exiv2/pull/3512 Patch

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

CWE-191Integer Underflow (Wrap or Wraparound)

Timeline

Published2 Mar 2026

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2026-27596 · NVD

UBUNTU-CVE-2026-27596 · OSV

DEBIAN-CVE-2026-27596 · OSV

CVE-2026-27596 · OSV

GHSA-3wgv-fg4w-75x7 · GHSA

Track software like this

Free during beta