CVE-2026-27631

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27631", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-20T22:02:30.028Z", "datePublished": "2026-03-02T19:40:45.351Z", "dateUpdated": "2026-03-02T20:28:01.516Z"}, "containers": {"cna": {"title": "Exiv2: Uncaught exception - cannot create std::vector larger than max_size()", "problemTypes": [{"descriptions": [{"cweId": "CWE-248", "lang": "en", "description": "CWE-248: Uncaught Exception", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/Exiv2/exiv2/security/advisories/GHSA-p2pw-7935-c73j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Exiv2/exiv2/security/advisories/GHSA-p2pw-7935-c73j"}, {"name": "https://github.com/Exiv2/exiv2/issues/3513", "tags": ["x_refsource_MISC"], "url": "https://github.com/Exiv2/exiv2/issues/3513"}, {"name": "https://github.com/Exiv2/exiv2/pull/3514", "tags": ["x_refsource_MISC"], "url": "https://github.com/Exiv2/exiv2/pull/3514"}, {"name": "https://github.com/Exiv2/exiv2/commit/659db316eef745899a778a1e0b760a971d1b69df", "tags": ["x_refsource_MISC"], "url": "https://github.com/Exiv2/exiv2/commit/659db316eef745899a778a1e0b760a971d1b69df"}], "affected": [{"vendor": "Exiv2", "product": "exiv2", "versions": [{"version": "< 0.28.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-02T19:40:45.351Z"}, "descriptions": [{"lang": "en", "value": "Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught exception was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. Due to an integer overflow, the code attempts to create a huge std::vector, which causes Exiv2 to crash with an uncaught exception. This issue has been patched in version 0.28.8."}], "source": {"advisory": "GHSA-p2pw-7935-c73j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T20:27:04.449308Z", "id": "CVE-2026-27631", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T20:28:01.516Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27631", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-02T20:27:04.449308Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T20:27:33.535Z"}}], "cna": {"title": "Exiv2: Uncaught exception - cannot create std::vector larger than max_size()", "source": {"advisory": "GHSA-p2pw-7935-c73j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "Exiv2", "product": "exiv2", "versions": [{"status": "affected", "version": "< 0.28.8"}]}], "references": [{"url": "https://github.com/Exiv2/exiv2/security/advisories/GHSA-p2pw-7935-c73j", "name": "https://github.com/Exiv2/exiv2/security/advisories/GHSA-p2pw-7935-c73j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Exiv2/exiv2/issues/3513", "name": "https://github.com/Exiv2/exiv2/issues/3513", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Exiv2/exiv2/pull/3514", "name": "https://github.com/Exiv2/exiv2/pull/3514", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Exiv2/exiv2/commit/659db316eef745899a778a1e0b760a971d1b69df", "name": "https://github.com/Exiv2/exiv2/commit/659db316eef745899a778a1e0b760a971d1b69df", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught exception was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. Due to an integer overflow, the code attempts to create a huge std::vector, which causes Exiv2 to crash with an uncaught exception. This issue has been patched in version 0.28.8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-248", "description": "CWE-248: Uncaught Exception"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-02T19:40:45.351Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27631", "state": "PUBLISHED", "dateUpdated": "2026-03-02T20:28:01.516Z", "dateReserved": "2026-02-20T22:02:30.028Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-02T19:40:45.351Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "exiv2", "vendor": "Exiv2", "versions": [{"status": "affected", "version": "< 0.28.8"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:exiv2:exiv2:*:*:*:*:*:*:*:*", "matchCriteriaId": "0FCFF025-C0AB-444E-9B45-351EE6AC735A", "versionEndIncluding": "0.28.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught exception was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. Due to an integer overflow, the code attempts to create a huge std::vector, which causes Exiv2 to crash with an uncaught exception. This issue has been patched in version 0.28.8."}, {"lang": "es", "value": "Exiv2 es una librer\u00eda de C++ y una utilidad de l\u00ednea de comandos para leer, escribir, eliminar y modificar metadatos de imagen Exif, IPTC, XMP e ICC. Antes de la versi\u00f3n 0.28.8, se encontr\u00f3 una excepci\u00f3n no capturada en Exiv2. La vulnerabilidad est\u00e1 en el componente de vista previa, que solo se activa al ejecutar Exiv2 con un argumento adicional de l\u00ednea de comandos, como -pp. Debido a un desbordamiento de entero, el c\u00f3digo intenta crear un std::vector enorme, lo que provoca que Exiv2 falle con una excepci\u00f3n no capturada. Este problema ha sido parcheado en la versi\u00f3n 0.28.8."}], "id": "CVE-2026-27631", "lastModified": "2026-06-17T10:27:25.397", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27631", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T20:27:04.449308Z", "version": "2.0.3"}}]}, "published": "2026-03-02T20:16:27.390", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Exiv2/exiv2/commit/659db316eef745899a778a1e0b760a971d1b69df"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/Exiv2/exiv2/issues/3513"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/Exiv2/exiv2/pull/3514"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/Exiv2/exiv2/security/advisories/GHSA-p2pw-7935-c73j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-248"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Exiv2: Exiv2: Denial of Service via integer overflow in preview component", "id": "2443986", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443986"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "details": ["Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught exception was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. Due to an integer overflow, the code attempts to create a huge std::vector, which causes Exiv2 to crash with an uncaught exception. This issue has been patched in version 0.28.8."], "name": "CVE-2026-27631", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "exiv2", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "exiv2", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "compat-exiv2-023", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "compat-exiv2-026", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "exiv2", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "compat-exiv2-026", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "exiv2", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "exiv2", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-02T19:40:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-27631\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-27631\nhttps://github.com/Exiv2/exiv2/commit/659db316eef745899a778a1e0b760a971d1b69df\nhttps://github.com/Exiv2/exiv2/issues/3513\nhttps://github.com/Exiv2/exiv2/pull/3514\nhttps://github.com/Exiv2/exiv2/security/advisories/GHSA-p2pw-7935-c73j"], "statement": "This LOW impact vulnerability in Exiv2 is triggered only when the command-line utility is executed with the `-pp` argument, which enables the preview component. Exploitation requires explicit user action and is not a default exposure in Red Hat products.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.28.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "exiv2", "source": "cna", "vendor": "Exiv2"}, "product": "exiv2", "vendor": "exiv2"}], "analysis": {"en": {"generated_at": "2026-04-16T14:17:19.327016+00:00", "value": {"mitigation_remediation": ["Upgrade to Exiv2 version 0.28.8 or later, which contains the fix for the integer\u2011overflow bug.", "If an upgrade cannot be performed immediately, ensure that the -pp preview option is not used in any automated scripts or services that call Exiv2.", "Validate command\u2011line arguments in any wrapper tools to confirm that numeric values do not exceed the limits of the std::vector maximum size, thereby preventing the integer overflow."], "summary": {"action": "Apply Patch", "impact": "Crash, Denial of Service"}, "threat_synthesis": {"affected_systems": "All installations of the Exiv2 library and command\u2011line utility using versions earlier than 0.28.8 are affected; the flaw is present across all supported operating systems on which the library is compiled.", "description_and_impact": "An uncaught exception in the preview component of the Exiv2 library is triggered by an integer overflow when Exiv2 is run with the -pp argument, causing the program to attempt to allocate a std::vector larger than the maximum allowed size and crash. This fault results in an abrupt termination of the program and corresponds to CWE\u2011248, indicating that unchecked conditions can lead to resource exhaustion or program instability.", "risk_and_exploitability": "The CVSS base score of 2.7 reflects a low overall severity, and the EPSS score of less than 1\u202f% suggests a very low probability of exploitation. The vulnerability is not included in the CISA KEV catalog. Exploitation requires local access to invoke Exiv2 with the -pp flag, so it is limited to environments where an attacker can supply arbitrary command\u2011line arguments. While the immediate risk is low, the crash can be leveraged to disrupt services that rely on Exiv2 for image metadata handling, resulting in a denial\u2011of\u2011service condition."}}}}, "created": "2026-03-03T08:41:03.762137+00:00", "updated": "2026-04-16T14:30:16.120314+00:00", "vendors": ["exiv2", "exiv2$PRODUCT$exiv2"]}