CVE-2026-49275
Updated exiv2 package fixes security vulnerabilities
Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (WebReady/Curl builds). (CVE-2026-68546) Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files. (CVE-2026-68547) Out of bounds read in CrwMap::decodeBasic. (CVE-2026-49275)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
OSV Score usedOESA-2026-3888
exiv2 security update
Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.
Security Fix(es):
Exiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275)
Exiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546)
Exiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.(CVE-2026-68547)
- Record
OESA-2026-3888- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV Score usedOESA-2026-3889
exiv2 security update
Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.
Security Fix(es):
Exiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275)
Exiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546)
Exiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.(CVE-2026-68547)
- Record
OESA-2026-3889- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV Score usedOESA-2026-3890
exiv2 security update
Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.
Security Fix(es):
Exiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275)
Exiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546)
Exiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.(CVE-2026-68547)
- Record
OESA-2026-3890- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV Score usedOESA-2026-3891
exiv2 security update
Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.
Security Fix(es):
Exiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275)
Exiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546)
Exiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.(CVE-2026-68547)
- Record
OESA-2026-3891- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV Score usedOESA-2026-4088
exiv2 security update
Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.
Security Fix(es):
Exiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275)
Exiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546)
Exiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.(CVE-2026-68547)
- Record
OESA-2026-4088- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2026-0379 No score
Updated exiv2 package fixes security vulnerabilities
Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (WebReady/Curl builds). (CVE-2026-68546) Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files. (CVE-2026-68547) Out of bounds read in CrwMap::decodeBasic. (CVE-2026-49275)
- Record
MGASA-2026-0379- Updated
- 2026-11-02
Show 6 moreShow less
OSVopenSUSE-SU-2026:11658-1 No score
exiv2-0.28.9-1.1 on GA media
These are all security issues fixed in the exiv2-0.28.9-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11658-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21904-1 No score
Security update for exiv2
This update for exiv2 fixes the following issues:
- CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic (bsc#1277791).
- CVE-2026-68546: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files (bsc#1277579).
- CVE-2026-68547: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (bsc#1277591).
Changes for exiv2:
- update to 0.28.9:
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-pwvq-9w4q-786w
- Record
openSUSE-SU-2026:21904-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23860-1 No score
Security update for exiv2
This update for exiv2 fixes the following issues:
- CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic (bsc#1277791).
- CVE-2026-68546: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files (bsc#1277579).
- CVE-2026-68547: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (bsc#1277591).
Changes for exiv2:
- update to 0.28.9:
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-pwvq-9w4q-786w
- Record
SUSE-SU-2026:23860-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23871-1 No score
Security update for exiv2
This update for exiv2 fixes the following issues:
- CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic (bsc#1277791).
- CVE-2026-68546: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files (bsc#1277579).
- CVE-2026-68547: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (bsc#1277591).
Changes for exiv2:
- update to 0.28.9:
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-pwvq-9w4q-786w
- Record
SUSE-SU-2026:23871-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4374-1 No score
Security update for exiv2
This update for exiv2 fixes the following issues:
- CVE-2026-49275: out of bounds read in CrwMap::decodeBasic (bsc#1277791).
- CVE-2026-68546: heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files (bsc#1277579).
- CVE-2026-68547: heap out-of-bounds write in RemoteIo when reading from a malicious remote server (bsc#1277591).
- Record
SUSE-SU-2026:4374-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-49275 No score
[GHSA-hxph-pv7w-8649: Out of bounds read in CrwMap::decodeBasic]
- Record
UBUNTU-CVE-2026-49275- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
exiv2Debian:12 |
All versions, plus listed versions 0.27.6-10.28.0+dfsg-10.28.0+dfsg-20.28.0+dfsg-30.28.0+dfsg-4 Show 13 moreShow less0.28.1+dfsg-10.28.1+dfsg-20.28.1+dfsg-30.28.2+dfsg-10.28.3+dfsg-10.28.3+dfsg-20.28.4+dfsg-10.28.4+dfsg-20.28.5+dfsg-10.28.7+dfsg-10.28.7+dfsg-20.28.8+dfsg-10.28.9+dfsg-1 |
None known |
exiv2Debian:13 |
All versions, plus listed versions 0.28.5+dfsg-10.28.7+dfsg-10.28.7+dfsg-20.28.8+dfsg-10.28.9+dfsg-1 |
None known |
exiv2Debian:14 |
before 0.28.9+dfsg-1, plus listed versions 0.28.5+dfsg-10.28.7+dfsg-10.28.7+dfsg-20.28.8+dfsg-1 |
0.28.9+dfsg-1 |
exiv2Mageia:10 |
before 0.28.9-1.mga10 | 0.28.9-1.mga10 |
exiv2openEuler:20.03-LTS-SP4 |
before 0.27.5-8.oe2003sp4 | 0.27.5-8.oe2003sp4 |
exiv2openEuler:22.03-LTS-SP4 |
before 0.27.5-8.oe2203sp4 | 0.27.5-8.oe2203sp4 |
exiv2openEuler:24.03-LTS-SP1 |
before 0.28.2-10.oe2403sp1 | 0.28.2-10.oe2403sp1 |
exiv2openEuler:24.03-LTS-SP3 |
before 0.28.2-10.oe2403sp3 | 0.28.2-10.oe2403sp3 |
exiv2openEuler:24.03-LTS-SP4 |
before 0.28.2-10.oe2403sp4 | 0.28.2-10.oe2403sp4 |
exiv2SUSE:Linux Enterprise Server 16.0 |
before 0.28.9-160000.1.1 | 0.28.9-160000.1.1 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
exiv2SUSE:Linux Enterprise Server for SAP applications 16.0 |
before 0.28.9-160000.1.1 | 0.28.9-160000.1.1 |
exiv2SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise Server 15 SP4-LTSS |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise Server 15 SP5-LTSS |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise Server 15 SP6-LTSS |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.25-1ubuntu10.25-2.10.25-2.1ubuntu16.04.10.25-2.1ubuntu16.04.20.25-2.1ubuntu16.04.3 Show 8 moreShow less0.25-2.1ubuntu16.04.40.25-2.1ubuntu16.04.50.25-2.1ubuntu16.04.60.25-2.1ubuntu16.04.7+esm10.25-2.1ubuntu16.04.7+esm20.25-2.1ubuntu16.04.7+esm30.25-2.1ubuntu16.04.7+esm40.25-2.1ubuntu16.04.7+esm5 |
None known |
exiv2Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.25-3.10.25-3.1ubuntu0.18.04.10.25-3.1ubuntu0.18.04.20.25-3.1ubuntu0.18.04.30.25-3.1ubuntu0.18.04.4 Show 6 moreShow less0.25-3.1ubuntu0.18.04.50.25-3.1ubuntu0.18.04.70.25-3.1ubuntu0.18.04.90.25-3.1ubuntu0.18.04.100.25-3.1ubuntu0.18.04.110.25-3.1ubuntu0.18.04.11+esm1 |
None known |
exiv2Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 0.25-4ubuntu20.25-4ubuntu30.27.2-8ubuntu20.27.2-8ubuntu2.20.27.2-8ubuntu2.4 Show 5 moreShow less0.27.2-8ubuntu2.50.27.2-8ubuntu2.60.27.2-8ubuntu2.70.27.2-8ubuntu2.7+esm10.27.2-8ubuntu2.7+esm3 |
None known |
exiv2Ubuntu:22.04:LTS |
All versions, plus listed versions 0.27.3-3ubuntu40.27.3-3.1ubuntu10.27.5-1ubuntu10.27.5-3ubuntu10.27.5-3ubuntu1.10.27.5-3ubuntu1.3 |
None known |
exiv2Ubuntu:24.04:LTS |
All versions, plus listed versions 0.27.6-10.27.6-1build10.27.6-1ubuntu0.10.27.6-1ubuntu0.3 |
None known |
exiv2Ubuntu:26.10 |
All versions, plus listed versions 0.28.8+dfsg-1 |
None known |
exiv2Ubuntu:26.04:LTS |
All versions, plus listed versions 0.28.5+dfsg-10.28.7+dfsg-20.28.8+dfsg-1 |
None known |
exiv2openSUSE:Tumbleweed |
before 0.28.9-1.1 | 0.28.9-1.1 |
exiv2openSUSE:Leap 16.0 |
before 0.28.9-160000.1.1 | 0.28.9-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-49275 is a critical vulnerability (CVSS 9.8) in exiv2, published September 1, 2026. No source lists public exploit code. Fixed in exiv2 0.28.9+dfsg-1.
References
security-tracker.debian.org/tracker/CVE-2026-49275
advisories.mageia.org/MGASA-2026-0379.html
bugs.mageia.org/show_bug.cgi?id=36221
openwall.com/lists/oss-security/2026/08/30/1
github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52
Show 24 moreShow less
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-3888
nvd.nist.gov/vuln/detail/CVE-2026-49275
suse.com/support/update/announcement/2026/suse-su-202623860-1
bugzilla.suse.com/1277579
ubuntu.com/security/CVE-2026-49275
cve.org/CVERecord?id=CVE-2026-49275