CVE-2012-2836
The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library (aka libexif)...
CVE-2012-2836 is a medium vulnerability (CVSS 6.4) in Libexif Project Libexif, published July 13, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.27%, the 93rd percentile. Fixed in libexif 0.6.21-r0.
The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.
Exploit likelihood
What each source reports
NVD Score used
The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.
- Record
CVE-2012-2836- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.
- Record
CVE-2012-2836- Updated
- 2026-11-02
EUVDEUVD-2012-2816 No score
The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.
- Record
EUVD-2012-2816- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g3xm-ccpr-wfpc No score
The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library (aka libexif)...
The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.
- Record
GHSA-g3xm-ccpr-wfpc- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVBELL-CVE-2012-2836
CVE-2012-2836 does not affect BellSoft software
- Record
BELL-CVE-2012-2836- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:P - Updated
- 2026-11-02
OSVALPINE-CVE-2012-2836 No score
The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.
- Record
ALPINE-CVE-2012-2836- Updated
- 2026-11-03
OSV No score
The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.
- Record
CVE-2012-2836- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-2836 No score
The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.
- Record
DEBIAN-CVE-2012-2836- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10510-1 No score
libexif-devel-0.6.21-10.8 on GA media
These are all security issues fixed in the libexif-devel-0.6.21-10.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10510-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libexifAlpine:v3.10 |
before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.11 |
before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.12 |
before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.13 |
before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.14 |
before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.15 |
before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.16 |
before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.17 |
before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.18 |
before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.19 |
before 0.6.21-r0 | 0.6.21-r0 |
Show 32 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libexifAlpine:v3.20 |
before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.21 |
before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.22 |
before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.23 |
before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.24 |
before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.8 |
before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.9 |
before 0.6.21-r0 | 0.6.21-r0 |
libexifDebian:12 |
before 0.6.20-3 | 0.6.20-3 |
libexifDebian:13 |
before 0.6.20-3 | 0.6.20-3 |
libexifDebian:14 |
before 0.6.20-3 | 0.6.20-3 |
libexifDebian:6.0 |
before 0.6.19-1+squeeze1, plus listed versions 0.6.19-1 |
0.6.19-1+squeeze1 |
libexifRed Hat:enterprise_linux:5::client |
before 0:0.6.21-1.el5_8 | 0:0.6.21-1.el5_8 |
libexif-debuginfoRed Hat:enterprise_linux:5::client |
before 0:0.6.21-1.el5_8 | 0:0.6.21-1.el5_8 |
libexifRed Hat:enterprise_linux:5::client_workstation |
before 0:0.6.21-1.el5_8 | 0:0.6.21-1.el5_8 |
libexif-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:0.6.21-1.el5_8 | 0:0.6.21-1.el5_8 |
libexif-develRed Hat:enterprise_linux:5::client_workstation |
before 0:0.6.21-1.el5_8 | 0:0.6.21-1.el5_8 |
libexifRed Hat:enterprise_linux:5::server |
before 0:0.6.21-1.el5_8 | 0:0.6.21-1.el5_8 |
libexif-debuginfoRed Hat:enterprise_linux:5::server |
before 0:0.6.21-1.el5_8 | 0:0.6.21-1.el5_8 |
libexif-develRed Hat:enterprise_linux:5::server |
before 0:0.6.21-1.el5_8 | 0:0.6.21-1.el5_8 |
libexifRed Hat:enterprise_linux:6::client |
before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexif-debuginfoRed Hat:enterprise_linux:6::client |
before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexif-develRed Hat:enterprise_linux:6::client |
before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexifRed Hat:enterprise_linux:6::computenode |
before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexif-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexif-develRed Hat:enterprise_linux:6::computenode |
before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexifRed Hat:enterprise_linux:6::server |
before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexif-debuginfoRed Hat:enterprise_linux:6::server |
before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexif-develRed Hat:enterprise_linux:6::server |
before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexifRed Hat:enterprise_linux:6::workstation |
before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexif-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexif-develRed Hat:enterprise_linux:6::workstation |
before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexifopenSUSE:Tumbleweed |
before 0.6.21-10.8 | 0.6.21-10.8 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | OSV |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
securityfocus.com/bid/54437
debian.org/security/2012/dsa-2559
lists.opensuse.org/opensuse-security-announce/2012-07/msg00015.html
sourceforge.net/mailarchive/message.php?msg_id=29534027
secunia.com/advisories/49988
rhn.redhat.com/errata/RHSA-2012-1255.html
Show 44 moreShow less
ubuntu.com/usn/USN-1513-1
nvd.nist.gov/vuln/detail/CVE-2012-2836
github.com/advisories/GHSA-g3xm-ccpr-wfpc
security.alpinelinux.org/vuln/CVE-2012-2836
docs.bell-sw.com/security/cves/CVE-2012-2836
security-tracker.debian.org/tracker/CVE-2012-2836
access.redhat.com/errata/RHSA-2012:1255
bugzilla.redhat.com/show_bug.cgi?id=839182
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1255.json
cve.org/CVERecord?id=CVE-2012-2812
suse.com/security/cve/CVE-2012-2812