{"id":"CVE-2018-14046","aliases":["EUVD-2018-0058","GHSA-48r6-v3wx-gxm5","PYSEC-2018-133","RHSA-2019:2101"],"status":"published","title":"Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.","description":"Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01688,"percentile":0.77204,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125"],"published":"2018-07-13T15:00:00Z","modified":"2026-10-20T10:49:48Z","affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"exiv2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"exiv2-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"exiv2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"exiv2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"exiv2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"exiv2-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"exiv2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"exiv2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"exiv2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"exiv2-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"exiv2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"exiv2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"exiv2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"exiv2-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"exiv2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"exiv2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-2.el7_6"}]}],"bundled":25}],"products":[{"vendor":"exiv2","product":"exiv2"}],"references":[{"url":"https://github.com/Exiv2/exiv2/issues/378","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2101","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14046","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-48r6-v3wx-gxm5"},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465061","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470737","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470913","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470950","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471772","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473888","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473889","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1475123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1475124","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1482295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1482296","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1482423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1494443","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1494467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1494776","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1494778","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1494780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1494781","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1494782","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1494786","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1494787","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1495043","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1524104","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1524107","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1524116","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1525055","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1537353","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1545237","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1561213","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1561217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1566260","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1566735","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1578659","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1579481","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1579544","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1590993","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1590994","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1594627","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1601628","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1632490","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1635045","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646555","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1649094","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1649101","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1652637","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1656187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1656195","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1660423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1660424","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1660425","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1660426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1664361","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2101.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-17724","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-17724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-17724","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-4868","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1531724","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-4868","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-4868","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-8976","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-8976","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8976","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-8977","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-8977","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8977","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-9305","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-9305","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-9305","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-10772","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-10772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10772","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-10958","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-10958","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10958","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-10998","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-10998","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10998","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-10999","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1579488","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-10999","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10999","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-11037","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-11037","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11037","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12264","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12264","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12264","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12265","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12265","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12265","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-14046","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14046","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-17282","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-17282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-17282","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-17581","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-17581","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-17581","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-18915","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-18915","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18915","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-19107","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-19107","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19107","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-19108","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-19108","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19108","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-19535","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-19535","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19535","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-19607","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-19607","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19607","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20096","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20096","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20096","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20097","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20097","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20098","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20098","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20098","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20099","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20099","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20099","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1684381","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9143","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-14046","description":"Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.","status":"published","published":"2018-07-13T15:00:00Z","modified":"2024-08-05T09:21:40.978Z","updated_at":"2026-11-02T14:35:00.948726Z"}],"euvd":[{"id":"EUVD-2018-0058","description":"Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.","status":"published","published":"2018-07-13T15:00:00Z","modified":"2024-08-05T09:21:40Z","updated_at":"2026-11-03T02:39:48.313733Z"}],"ghsa":[{"id":"GHSA-48r6-v3wx-gxm5","title":"Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.","description":"Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.","status":"published","published":"2022-05-13T01:49:53Z","modified":"2023-02-02T05:01:56Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:51:18.541099Z"}],"nvd":[{"id":"CVE-2018-14046","description":"Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.","status":"published","published":"2018-07-13T15:29:00.283Z","modified":"2026-06-17T01:40:32.367Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:04:32.929986Z"}],"osv":[{"id":"CVE-2018-14046","description":"Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.","status":"published","published":"2018-07-13T15:29:00.283Z","modified":"2026-10-20T10:49:48.059440701Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.242347Z"},{"id":"PYSEC-2018-133","description":"Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.","status":"withdrawn","published":"2018-07-13T15:29:00Z","modified":"2025-10-09T05:31:46.245724Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"RHSA-2019:2101","title":"Red Hat Security Advisory: exiv2 security, bug fix, and enhancement update","status":"published","published":"2024-09-16T02:04:53Z","modified":"2026-06-27T10:07:48Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"}]}}