CVE-2026-27631Disclosure(exiv2 / exiv2)

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch exiv2 exiv2 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught exception was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. Due to an integer overflow, the code attempts to create a huge std::vector, which causes Exiv2 to crash with an uncaught exception. This issue has been patched in version 0.28.8.

exiv2 CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Other references

https://github.com/Exiv2/exiv2/issues/3513

Weakness type (CWE)

CWE-248

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

exiv2

Threat summary

Patch or workaround signal is available
5 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 1d ago at 4 mentions (2026-03-02); latest day: 1
5 total mentions across 2 days

Affected systems

Vendors

exiv2

Products

exiv2

Deep dive

Activity timeline5 mentions / 2d

Signal classification3 categories

Disclosure

360.0%

General

120.0%

Patch

120.0%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-02	4	Disclosure3General1
2026-03-08	1	Patch1

Full discourse5 posts

Open Source Security mailing list@oss_security215d
Patch
Exiv2 0.28.8 fixes 3 CVEs https://www.openwall.com/lists/oss-security/2026/03/02/3 CVE-2026-25884: Out-of-bounds read in CrwMap::decode0x0805 CVE-2026-27596: Integer overflow in LoaderNative::getData() causes out-of-bounds read CVE-2026-27631: Uncaught exception: cannot create std::vector larger than max_size()
Post summary
Exiv2 0.28.8 addresses three CVEs involving out‑of‑bounds reads and integer overflows, providing patches but no PoC or evidence of exploitation.
00022317
4.4K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds220d
Disclosure
CVE-2026-27631 Exiv2 Metadata Library Denial of Service via Uncaught Exception Vulnerab... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27631 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The post announces CVE-2026-27631, a Denial of Service vulnerability in Exiv2, with links to details but no PoC, exploit, or patch information.
0000048
4.0K followersView on X
Infoflowcloud@infoflowcloud220d
Disclosure
🚨*CVE* CVE-2026-27631 Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught excep… https://www.cve.org/CVERecord?id=CVE-2026-27631 ----- Traducción: CVE-2026-27631 Exi… http://infoflow.cloud`
Post summary
The post announces CVE-2026-27631, noting an uncaught exception in Exiv2 before version 0.28.8, but provides no PoC, exploit, patch, or active exploitation details.
0000039
55 followersView on X
CVE@CVEnew220d
General
CVE-2026-27631 Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught excep… https://www.cve.org/CVERecord?id=CVE-2026-27631
Post summary
The text references CVE-2026-27631, noting an uncaught exception in Exiv2 before version 0.28.8, but provides no further details or actionable information.
00000577
56.6K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash220d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-27631 - Exiv2: Uncaught exception - cannot create std::vector larger than max_size() Intel Report: https://ift.tt/eYlEHXy
Post summary
Alert announces CVE-2026-27631 in Exiv2, detailing an uncaught exception caused by exceeding std::vector max_size, with a link to an Intel report.
0000033
342 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	exiv2	exiv2	-	-	-

Explore more

Back to dashboard exiv2 CVEs exiv2 vulnerabilities

What researchers are saying

CVE-2026-27631

Open Source Security mailing list@oss_securityPatch

Exiv2 0.28.8 addresses three CVEs involving out‑of‑bounds reads and integer overflows, providing patches but no PoC or evidence of exploitation.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces CVE-2026-27631, a Denial of Service vulnerability in Exiv2, with links to details but no PoC, exploit, or patch information.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE-2026-27631, noting an uncaught exception in Exiv2 before version 0.28.8, but provides no PoC, exploit, patch, or active exploitation details.

CVE@CVEnewGeneral

The text references CVE-2026-27631, noting an uncaught exception in Exiv2 before version 0.28.8, but provides no further details or actionable information.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

Alert announces CVE-2026-27631 in Exiv2, detailing an uncaught exception caused by exceeding std::vector max_size, with a link to an Intel report.