CVE-2018-12648
The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has...
The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.
- Record
CVE-2018-12648- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.
- Record
CVE-2018-12648- Updated
- 2026-11-02
EUVDEUVD-2018-4603 No score
The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.
- Record
EUVD-2018-4603- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r54v-h92m-5v94
The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has...
The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.
- Record
GHSA-r54v-h92m-5v94- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVAZL-44871
CVE-2018-12648 affecting package exempi 2.6.5-1
The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.
- Record
AZL-44871- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
OSV
The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.
- Record
CVE-2018-12648- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2018-12648
The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.
- Record
DEBIAN-CVE-2018-12648- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-12648
The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.
- Record
UBUNTU-CVE-2018-12648- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0416 No score
Updated exempi packages fix security vulnerability
It was found that the WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference (CVE-2018-12648).
- Record
MGASA-2018-0416- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1649-1 No score
Security update for exempi
This update for exempi fixes the following issues:
- CVE-2018-12648: Fixed a NULL pointer dereference (crash) issue when processing webp files (bsc#1098946).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1649-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1657-1 No score
Security update for exempi
This update for exempi fixes the following issues:
- CVE-2018-12648: Fixed a NULL pointer dereference (crash) issue when processing webp files (bsc#1098946).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1657-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10745-1 No score
exempi-tools-2.5.2-1.3 on GA media
These are all security issues fixed in the exempi-tools-2.5.2-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10745-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1603-1 No score
Security update for exempi
This update for exempi fixes the following issues:
- CVE-2018-12648: Fixed a NULL pointer dereference (crash) issue when processing webp files (bsc#1098946).
- Record
SUSE-SU-2019:1603-1- Updated
- 2026-11-02
OSVUSN-5483-1 No score
exempi vulnerabilities
It was discovered that Exempi incorrectly handled certain media files. If a user or automated system were tricked into opening a specially crafted file, a remote attacker could cause Exempi to stop responding or crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-5483-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
exempiAzure Linux:3 |
through 2.6.5-1 | None known |
exempiDebian:12 |
before 2.5.0-2 | 2.5.0-2 |
exempiDebian:13 |
before 2.5.0-2 | 2.5.0-2 |
exempiDebian:14 |
before 2.5.0-2 | 2.5.0-2 |
exempiMageia:6 |
before 2.4.5-1.1.mga6 | 2.4.5-1.1.mga6 |
exempiSUSE:Linux Enterprise Module for Desktop Applications 15 |
before 2.4.5-3.3.2 | 2.4.5-3.3.2 |
exempiSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 |
before 2.4.5-3.3.2 | 2.4.5-3.3.2 |
exempiUbuntu:18.04:LTS |
before 2.4.5-2ubuntu0.1, plus listed versions 2.4.3-1ubuntu12.4.5-2 |
2.4.5-2ubuntu0.1 |
exempiUbuntu:18.04:LTS From an advisory covering 22 CVEs |
before 2.4.5-2ubuntu0.1, plus listed versions 2.4.3-1ubuntu12.4.5-2 |
2.4.5-2ubuntu0.1 |
exempiUbuntu:20.04:LTS From an advisory covering 22 CVEs |
before 2.5.1-1ubuntu0.1, plus listed versions 2.5.1-12.5.1-1build1 |
2.5.1-1ubuntu0.1 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
exempiUbuntu:22.04:LTS From an advisory covering 22 CVEs |
before 2.5.2-1ubuntu0.22.04.1, plus listed versions 2.5.2-1build1 |
2.5.2-1ubuntu0.22.04.1 |
exempiopenSUSE:Leap 15.0 |
before 2.4.5-lp150.2.3.1 | 2.4.5-lp150.2.3.1 |
exempiopenSUSE:Leap 15.1 |
before 2.4.5-lp151.3.3.1 | 2.4.5-lp151.3.3.1 |
exempiopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 2.5.2-1.3 | 2.5.2-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-12648 is a high vulnerability (CVSS 7.5) in Exempi Project Exempi, published June 22, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.24%, the 82nd percentile. Fixed in exempi 2.5.0-2.
References
bugs.freedesktop.org/show_bug.cgi?id=106981
lists.opensuse.org/opensuse-security-announce/2019-06/msg00070.html
nvd.nist.gov/vuln/detail/CVE-2018-12648
github.com/advisories/GHSA-r54v-h92m-5v94
security-tracker.debian.org/tracker/CVE-2018-12648
Show 36 moreShow less
advisories.mageia.org/MGASA-2018-0416.html
bugs.mageia.org/show_bug.cgi?id=23702
lists.fedoraproject.org/archives/list/[email protected]/thread/WFS4YRRYY745JRYSEGGT7JFJTVC4F62H
suse.com/support/update/announcement/2019/suse-su-20191603-1
bugzilla.suse.com/1098946
ubuntu.com/security/CVE-2018-12648
cve.org/CVERecord?id=CVE-2018-12648