CVE-2026-49275
Updated exiv2 package fixes security vulnerabilities
Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (WebReady/Curl builds). (CVE-2026-68546) Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files. (CVE-2026-68547) Out of bounds read in CrwMap::decodeBasic. (CVE-2026-49275)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
OSV Score usedOESA-2026-3888
exiv2 security update
Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.
Security Fix(es):
Exiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275)
Exiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546)
Exiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.(CVE-2026-68547)
- Record
OESA-2026-3888- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV Score usedOESA-2026-3889
exiv2 security update
Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.
Security Fix(es):
Exiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275)
Exiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546)
Exiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.(CVE-2026-68547)
- Record
OESA-2026-3889- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV Score usedOESA-2026-3890
exiv2 security update
Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.
Security Fix(es):
Exiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275)
Exiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546)
Exiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.(CVE-2026-68547)
- Record
OESA-2026-3890- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV Score usedOESA-2026-3891
exiv2 security update
Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.
Security Fix(es):
Exiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275)
Exiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546)
Exiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.(CVE-2026-68547)
- Record
OESA-2026-3891- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV Score usedOESA-2026-4088
exiv2 security update
Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.
Security Fix(es):
Exiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275)
Exiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546)
Exiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.(CVE-2026-68547)
- Record
OESA-2026-4088- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2026-0379 No score
Updated exiv2 package fixes security vulnerabilities
Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (WebReady/Curl builds). (CVE-2026-68546) Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files. (CVE-2026-68547) Out of bounds read in CrwMap::decodeBasic. (CVE-2026-49275)
- Record
MGASA-2026-0379- Updated
- 2026-11-02
Show 6 moreShow less
OSVopenSUSE-SU-2026:11658-1 No score
exiv2-0.28.9-1.1 on GA media
These are all security issues fixed in the exiv2-0.28.9-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11658-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21904-1 No score
Security update for exiv2
This update for exiv2 fixes the following issues:
- CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic (bsc#1277791).
- CVE-2026-68546: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files (bsc#1277579).
- CVE-2026-68547: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (bsc#1277591).
Changes for exiv2:
- update to 0.28.9:
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-pwvq-9w4q-786w
- Record
openSUSE-SU-2026:21904-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23860-1 No score
Security update for exiv2
This update for exiv2 fixes the following issues:
- CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic (bsc#1277791).
- CVE-2026-68546: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files (bsc#1277579).
- CVE-2026-68547: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (bsc#1277591).
Changes for exiv2:
- update to 0.28.9:
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-pwvq-9w4q-786w
- Record
SUSE-SU-2026:23860-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23871-1 No score
Security update for exiv2
This update for exiv2 fixes the following issues:
- CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic (bsc#1277791).
- CVE-2026-68546: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files (bsc#1277579).
- CVE-2026-68547: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (bsc#1277591).
Changes for exiv2:
- update to 0.28.9:
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-pwvq-9w4q-786w
- Record
SUSE-SU-2026:23871-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4374-1 No score
Security update for exiv2
This update for exiv2 fixes the following issues:
- CVE-2026-49275: out of bounds read in CrwMap::decodeBasic (bsc#1277791).
- CVE-2026-68546: heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files (bsc#1277579).
- CVE-2026-68547: heap out-of-bounds write in RemoteIo when reading from a malicious remote server (bsc#1277591).
- Record
SUSE-SU-2026:4374-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-49275 No score
[GHSA-hxph-pv7w-8649: Out of bounds read in CrwMap::decodeBasic]
- Record
UBUNTU-CVE-2026-49275- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
exiv2Debian:12 |
All versions, plus listed versions 0.27.6-10.28.0+dfsg-10.28.0+dfsg-20.28.0+dfsg-30.28.0+dfsg-4 Show 13 moreShow less0.28.1+dfsg-10.28.1+dfsg-20.28.1+dfsg-30.28.2+dfsg-10.28.3+dfsg-10.28.3+dfsg-20.28.4+dfsg-10.28.4+dfsg-20.28.5+dfsg-10.28.7+dfsg-10.28.7+dfsg-20.28.8+dfsg-10.28.9+dfsg-1 |
None known |
exiv2Debian:13 |
All versions, plus listed versions 0.28.5+dfsg-10.28.7+dfsg-10.28.7+dfsg-20.28.8+dfsg-10.28.9+dfsg-1 |
None known |
exiv2Debian:14 |
before 0.28.9+dfsg-1, plus listed versions 0.28.5+dfsg-10.28.7+dfsg-10.28.7+dfsg-20.28.8+dfsg-1 |
0.28.9+dfsg-1 |
exiv2Mageia:10 From an advisory covering 3 CVEs |
before 0.28.9-1.mga10 | 0.28.9-1.mga10 |
exiv2openEuler:20.03-LTS-SP4 From an advisory covering 3 CVEs |
before 0.27.5-8.oe2003sp4 | 0.27.5-8.oe2003sp4 |
exiv2openEuler:22.03-LTS-SP4 From an advisory covering 3 CVEs |
before 0.27.5-8.oe2203sp4 | 0.27.5-8.oe2203sp4 |
exiv2openEuler:24.03-LTS-SP1 From an advisory covering 3 CVEs |
before 0.28.2-10.oe2403sp1 | 0.28.2-10.oe2403sp1 |
exiv2openEuler:24.03-LTS-SP3 From an advisory covering 3 CVEs |
before 0.28.2-10.oe2403sp3 | 0.28.2-10.oe2403sp3 |
exiv2openEuler:24.03-LTS-SP4 From an advisory covering 3 CVEs |
before 0.28.2-10.oe2403sp4 | 0.28.2-10.oe2403sp4 |
exiv2SUSE:Linux Enterprise Server 16.0 From an advisory covering 3 CVEs |
before 0.28.9-160000.1.1 | 0.28.9-160000.1.1 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
exiv2SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 3 CVEs |
before 0.28.9-160000.1.1 | 0.28.9-160000.1.1 |
exiv2SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 From an advisory covering 3 CVEs |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 3 CVEs |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 3 CVEs |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 3 CVEs |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 3 CVEs |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 3 CVEs |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 3 CVEs |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 3 CVEs |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 3 CVEs |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 3 CVEs |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 3 CVEs |
before 0.27.5-150400.15.10.1 | 0.27.5-150400.15.10.1 |
exiv2Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.25-1ubuntu10.25-2.10.25-2.1ubuntu16.04.10.25-2.1ubuntu16.04.20.25-2.1ubuntu16.04.3 Show 8 moreShow less0.25-2.1ubuntu16.04.40.25-2.1ubuntu16.04.50.25-2.1ubuntu16.04.60.25-2.1ubuntu16.04.7+esm10.25-2.1ubuntu16.04.7+esm20.25-2.1ubuntu16.04.7+esm30.25-2.1ubuntu16.04.7+esm40.25-2.1ubuntu16.04.7+esm5 |
None known |
exiv2Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.25-3.10.25-3.1ubuntu0.18.04.10.25-3.1ubuntu0.18.04.20.25-3.1ubuntu0.18.04.30.25-3.1ubuntu0.18.04.4 Show 6 moreShow less0.25-3.1ubuntu0.18.04.50.25-3.1ubuntu0.18.04.70.25-3.1ubuntu0.18.04.90.25-3.1ubuntu0.18.04.100.25-3.1ubuntu0.18.04.110.25-3.1ubuntu0.18.04.11+esm1 |
None known |
exiv2Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 0.25-4ubuntu20.25-4ubuntu30.27.2-8ubuntu20.27.2-8ubuntu2.20.27.2-8ubuntu2.4 Show 5 moreShow less0.27.2-8ubuntu2.50.27.2-8ubuntu2.60.27.2-8ubuntu2.70.27.2-8ubuntu2.7+esm10.27.2-8ubuntu2.7+esm3 |
None known |
exiv2Ubuntu:22.04:LTS |
All versions, plus listed versions 0.27.3-3ubuntu40.27.3-3.1ubuntu10.27.5-1ubuntu10.27.5-3ubuntu10.27.5-3ubuntu1.10.27.5-3ubuntu1.3 |
None known |
exiv2Ubuntu:24.04:LTS |
All versions, plus listed versions 0.27.6-10.27.6-1build10.27.6-1ubuntu0.10.27.6-1ubuntu0.3 |
None known |
exiv2Ubuntu:26.10 |
All versions, plus listed versions 0.28.8+dfsg-1 |
None known |
exiv2Ubuntu:26.04:LTS |
All versions, plus listed versions 0.28.5+dfsg-10.28.7+dfsg-20.28.8+dfsg-1 |
None known |
exiv2openSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 0.28.9-1.1 | 0.28.9-1.1 |
exiv2openSUSE:Leap 16.0 From an advisory covering 3 CVEs |
before 0.28.9-160000.1.1 | 0.28.9-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-49275 is a critical vulnerability (CVSS 9.8) in exiv2, published September 1, 2026. No source lists public exploit code. Fixed in exiv2 0.28.9+dfsg-1.
References
security-tracker.debian.org/tracker/CVE-2026-49275
advisories.mageia.org/MGASA-2026-0379.html
bugs.mageia.org/show_bug.cgi?id=36221
openwall.com/lists/oss-security/2026/08/30/1
github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52
Show 24 moreShow less
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-3888
nvd.nist.gov/vuln/detail/CVE-2026-49275
suse.com/support/update/announcement/2026/suse-su-202623860-1
bugzilla.suse.com/1277579
ubuntu.com/security/CVE-2026-49275
cve.org/CVERecord?id=CVE-2026-49275