Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade exiv2 | Aug 22, 2024 | Aug 9, 2021 |
| Debian | — | Upgrade exiv2 | Jan 12, 2023 | Aug 9, 2021 |
| Gentoo Linux | — | Upgrade media-gfx/exiv2. | Dec 27, 2023 | Aug 9, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade exiv2-libs | Feb 24, 2022 | Aug 9, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade exiv2-libs | Nov 12, 2021 | Aug 9, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade exiv2Upgrade exiv2-libs | Nov 2, 2021 | Aug 9, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Aug 9, 2021 |
| Suse | — | Upgrade libexiv2-xmp-staticUpgrade libexiv2-27Upgrade libexiv2-27-32bitUpgrade libexiv2-develUpgrade libexiv2-26-32bitUpgrade libexiv2-docUpgrade exiv2-langUpgrade libexiv2-12Upgrade exiv2Upgrade libexiv2-26 | Oct 26, 2022 | Aug 9, 2021 |
| Ubuntu | — | Upgrade libexiv2-27Upgrade libexiv2-14Upgrade exiv2Upgrade libexiv2-14 (Ubuntu Pro) | Aug 18, 2021 | Aug 9, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub