CVE-2026-27596Disclosure(exiv2 / exiv2)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch exiv2 exiv2 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. The out-of-bounds read is at a 4GB offset, which usually causes Exiv2 to crash. This issue has been patched in version 0.28.8.

exiv2 CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Other references

Weakness type (CWE)

CWE-125CWE-191

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

exiv2

Threat summary

Patch or workaround signal is available
5 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 1d ago at 4 mentions (2026-03-02); latest day: 1
5 total mentions across 2 days

Affected systems

Vendors

exiv2

Products

exiv2

Deep dive

Activity timeline5 mentions / 2d

Signal classification3 categories

Disclosure

360.0%

General

120.0%

Patch

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-02	4	Disclosure3General1
2026-03-08	1	Patch1

Full discourse5 posts

Open Source Security mailing list@oss_security216d
Patch
Exiv2 0.28.8 fixes 3 CVEs https://www.openwall.com/lists/oss-security/2026/03/02/3 CVE-2026-25884: Out-of-bounds read in CrwMap::decode0x0805 CVE-2026-27596: Integer overflow in LoaderNative::getData() causes out-of-bounds read CVE-2026-27631: Uncaught exception: cannot create std::vector larger than max_size()
Post summary
The post announces the release of Exiv2 0.28.8, which patches three CVEs involving out‑of‑bounds reads, integer overflow, and an uncaught exception, but provides no proof‑of‑concept or exploit details.
00022317
4.4K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds221d
Disclosure
CVE-2026-27596 Out-of-Bounds Read Vulnerability in Exiv2 Metadata Library Before 0.28.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27596
Post summary
A new out-of-bounds read vulnerability (CVE-2026-27596) affecting Exiv2 metadata library versions before 0.28.8 has been disclosed, with no PoC, exploit, or patch details provided.
0000046
4.0K followersView on X
Infoflowcloud@infoflowcloud221d
Disclosure
🚨*CVE* CVE-2026-27596 Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds … https://www.cve.org/CVERecord?id=CVE-2026-27596 ----- Traducción: CVE-2026-27596 Exi… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑27596, describing it as an out‑of‑bounds vulnerability in Exiv2 before version 0.28.8, without providing PoC, exploit, or patch details.
0000037
55 followersView on X
CVE@CVEnew221d
General
CVE-2026-27596 Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds … https://www.cve.org/CVERecord?id=CVE-2026-27596
Post summary
The text references CVE-2026-27596, noting an out‑of‑bounds issue in Exiv2 before version 0.28.8, but provides no further details on exploitation, patches, or PoC.
00000338
56.6K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash221d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-27596 - Exiv2: Integer Underflow in LoaderNative::getData() Causes Heap Buffer Overflow Intel Report: https://ift.tt/dO5rvRm
Post summary
The alert announces CVE-2026-27596, an integer underflow leading to a heap buffer overflow in Exiv2, and provides a link to an Intel report.
0000033
342 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	exiv2	exiv2	-	-	-

Explore more

Back to dashboard exiv2 CVEs exiv2 vulnerabilities

What researchers are saying

CVE-2026-27596

Open Source Security mailing list@oss_securityPatch

The post announces the release of Exiv2 0.28.8, which patches three CVEs involving out‑of‑bounds reads, integer overflow, and an uncaught exception, but provides no proof‑of‑concept or exploit details.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A new out-of-bounds read vulnerability (CVE-2026-27596) affecting Exiv2 metadata library versions before 0.28.8 has been disclosed, with no PoC, exploit, or patch details provided.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE‑2026‑27596, describing it as an out‑of‑bounds vulnerability in Exiv2 before version 0.28.8, without providing PoC, exploit, or patch details.

CVE@CVEnewGeneral

The text references CVE-2026-27596, noting an out‑of‑bounds issue in Exiv2 before version 0.28.8, but provides no further details on exploitation, patches, or PoC.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

The alert announces CVE-2026-27596, an integer underflow leading to a heap buffer overflow in Exiv2, and provides a link to an Intel report.