CVE-2026-27596 Details
Description
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. The out-of-bounds read is at a 4GB offset, which usually causes Exiv2 to crash. This issue has been patched in version 0.28.8.
A memory safety vulnerability has been identified in the Exiv2 library, specifically in the preview component, prior to version 0.28.8. The issue arises from an unsigned integer underflow in the `LoaderNative::getData()` function, which processes crafted EPS files containing a Photoshop IRB preview record with a data size less than 28 bytes. This underflow causes a massive out-of-bounds read from the heap, leading to a buffer overflow and a guaranteed crash of the application. The vulnerability can be exploited by running Exiv2 with the `-pp` argument to extract previews from the crafted EPS files.
Users can upgrade to Exiv2 version 0.28.8, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Exiv2/exiv2/commit/eaa9e21aabe06b3f91cfe66686f5ebc3ca3c0ed4 | [email protected] | Patch |
| https://github.com/Exiv2/exiv2/issues/3511 | [email protected] | Issue Tracking |
| https://github.com/Exiv2/exiv2/pull/3512 | [email protected] | Issue Tracking |
| https://github.com/Exiv2/exiv2/security/advisories/GHSA-3wgv-fg4w-75x7 | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-191 | Integer Underflow (Wrap or Wraparound) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| exiv2 exiv2 | < 0.28.8 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 5, 2026 | Initial Analysis | [email protected] |
| Mar 2, 2026 | New CVE Received | [email protected] |