The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.1. The vulnerable function, `QuickTimeVideo::NikonTagsDecoder`, was new in v0.28.0, so Exiv2 versions before v0.28 are _not_ affected. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted video file. In most cases this out of bounds read will result in a crash. This bug is fixed in version v0.28.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade exiv2 | Aug 22, 2024 | Feb 12, 2024 |
| Amazon Linux Ami 2 | — | Upgrade exiv2-develUpgrade exiv2-debuginfoUpgrade exiv2-docUpgrade exiv2Upgrade exiv2-libs | Jan 10, 2025 | Feb 12, 2024 |
| Debian | — | Upgrade exiv2 | May 15, 2025 | Feb 12, 2024 |
| Suse | — | Upgrade libexiv2-28Upgrade libexiv2-28-x86-64-v3 | Dec 5, 2025 | Dec 5, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub