CVE-2026-25884Disclosure(exiv2 / exiv2)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch exiv2 exiv2 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found. The vulnerability is in the CRW image parser. This issue has been patched in version 0.28.8.

exiv2 CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

https://github.com/Exiv2/exiv2/security/advisories/GHSA-9mxq-4j5g-5wrp

Weakness type (CWE)

CWE-125

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

exiv2

Threat summary

Patch or workaround signal is available
5 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 1d ago at 4 mentions (2026-03-02); latest day: 1
5 total mentions across 2 days

Affected systems

Vendors

exiv2

Products

exiv2

Deep dive

Activity timeline5 mentions / 2d

Signal classification3 categories

Disclosure

360.0%

General

120.0%

Patch

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-02	4	Disclosure3General1
2026-03-08	1	Patch1

Full discourse5 posts

Open Source Security mailing list@oss_security216d
Patch
Exiv2 0.28.8 fixes 3 CVEs https://www.openwall.com/lists/oss-security/2026/03/02/3 CVE-2026-25884: Out-of-bounds read in CrwMap::decode0x0805 CVE-2026-27596: Integer overflow in LoaderNative::getData() causes out-of-bounds read CVE-2026-27631: Uncaught exception: cannot create std::vector larger than max_size()
Post summary
The message announces that version 0.28.8 of Exiv2 provides patches for three CVEs involving out-of-bounds reads and an integer overflow, offering a direct mitigation.
00022317
4.4K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds222d
Disclosure
CVE-2026-25884 Out-of-Bounds Read Vulnerability in Exiv2 CRW Image Parser Before 0.28.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25884
Post summary
A new out‑of‑bounds read vulnerability (CVE‑2026‑25884) affecting Exiv2 CRW image parser versions before 0.28.8 has been disclosed, with no PoC, exploit, or patch details provided.
0000049
4.0K followersView on X
Infoflowcloud@infoflowcloud222d
Disclosure
🚨*CVE* CVE-2026-25884 Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds … https://www.cve.org/CVERecord?id=CVE-2026-25884 ----- Traducción: CVE-2026-25884 Exi… http://infoflow.cloud`
Post summary
The post announces CVE-2026-25884, an out-of-bounds vulnerability in Exiv2 before version 0.28.8, and links to the official CVE record.
0000040
55 followersView on X
CVE@CVEnew222d
General
CVE-2026-25884 Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds … https://www.cve.org/CVERecord?id=CVE-2026-25884
Post summary
The text references CVE-2026-25884, noting an out-of-bounds issue in Exiv2 before version 0.28.8, but provides no further details such as PoC, exploit, patch, or active exploitation.
00000272
56.6K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash222d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-25884 - Exiv2: Out-of-bounds read in CrwMap::decode0x0805 Intel Report: https://ift.tt/fhisexn
Post summary
A new CVE-2026-25884 affecting Exiv2 has been reported, describing an out-of-bounds read in CrwMap::decode0x0805, with an Intel report linked for further details.
0000034
342 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	exiv2	exiv2	-	-	-

Explore more

Back to dashboard exiv2 CVEs exiv2 vulnerabilities

What researchers are saying

CVE-2026-25884

Open Source Security mailing list@oss_securityPatch

The message announces that version 0.28.8 of Exiv2 provides patches for three CVEs involving out-of-bounds reads and an integer overflow, offering a direct mitigation.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A new out‑of‑bounds read vulnerability (CVE‑2026‑25884) affecting Exiv2 CRW image parser versions before 0.28.8 has been disclosed, with no PoC, exploit, or patch details provided.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE-2026-25884, an out-of-bounds vulnerability in Exiv2 before version 0.28.8, and links to the official CVE record.

CVE@CVEnewGeneral

The text references CVE-2026-25884, noting an out-of-bounds issue in Exiv2 before version 0.28.8, but provides no further details such as PoC, exploit, patch, or active exploitation.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

A new CVE-2026-25884 affecting Exiv2 has been reported, describing an out-of-bounds read in CrwMap::decode0x0805, with an Intel report linked for further details.