{"id":"CVE-2020-18771","aliases":["CLSA-2026-1787932207","DEBIAN-CVE-2020-18771","DLA-3265-1","EUVD-2021-0075","GHSA-q7h8-cc9p-3543","PYSEC-2021-882","UBUNTU-CVE-2020-18771","USN-8103-1"],"status":"published","title":"Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in...","description":"Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn_int.cpp which can result in an information leak.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01832,"percentile":0.79176,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2021-08-23T00:00:00Z","modified":"2026-10-26T12:01:42Z","fixes":[{"ecosystem":"Debian:12","package":"exiv2","fixed_in":["0.27.2-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"exiv2","fixed_in":["0.27.2-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"exiv2","fixed_in":["0.27.2-6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exiv2","fixed_in":["0.25-2.1ubuntu16.04.7+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exiv2","fixed_in":["0.25-3.1ubuntu0.18.04.11+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exiv2","fixed_in":["0.27.2-8ubuntu2.7+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"exiv2","fixed_in":["0.27.5-3ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"exiv2","fixed_in":["0.27.6-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"exiv2","fixed_in":["0.28.5+dfsg-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-3.1ubuntu0.18.04.11+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libexiv2-14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-3.1ubuntu0.18.04.11+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libexiv2-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-3.1ubuntu0.18.04.11+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libexiv2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-3.1ubuntu0.18.04.11+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-6"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-4+deb10u4"}]}],"versions":["0.25-4","0.25-4+deb10u1","0.25-4+deb10u2","0.25-4+deb10u3"],"bundled":26},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-2.1ubuntu16.04.7+esm5"}]}],"versions":["0.25-1ubuntu1","0.25-2.1","0.25-2.1ubuntu16.04.1","0.25-2.1ubuntu16.04.2","0.25-2.1ubuntu16.04.3","0.25-2.1ubuntu16.04.4","0.25-2.1ubuntu16.04.5","0.25-2.1ubuntu16.04.6","0.25-2.1ubuntu16.04.7+esm1","0.25-2.1ubuntu16.04.7+esm2","0.25-2.1ubuntu16.04.7+esm3","0.25-2.1ubuntu16.04.7+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-3.1ubuntu0.18.04.11+esm1"}]}],"versions":["0.25-3.1","0.25-3.1ubuntu0.18.04.1","0.25-3.1ubuntu0.18.04.2","0.25-3.1ubuntu0.18.04.3","0.25-3.1ubuntu0.18.04.4","0.25-3.1ubuntu0.18.04.5","0.25-3.1ubuntu0.18.04.7","0.25-3.1ubuntu0.18.04.9","0.25-3.1ubuntu0.18.04.10","0.25-3.1ubuntu0.18.04.11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-2.1ubuntu16.04.7+esm5"}]}],"versions":["0.25-1ubuntu1","0.25-2.1","0.25-2.1ubuntu16.04.1","0.25-2.1ubuntu16.04.2","0.25-2.1ubuntu16.04.3","0.25-2.1ubuntu16.04.4","0.25-2.1ubuntu16.04.5","0.25-2.1ubuntu16.04.6","0.25-2.1ubuntu16.04.7+esm1","0.25-2.1ubuntu16.04.7+esm2","0.25-2.1ubuntu16.04.7+esm3","0.25-2.1ubuntu16.04.7+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-3.1ubuntu0.18.04.11+esm1"}]}],"versions":["0.25-3.1","0.25-3.1ubuntu0.18.04.1","0.25-3.1ubuntu0.18.04.2","0.25-3.1ubuntu0.18.04.3","0.25-3.1ubuntu0.18.04.4","0.25-3.1ubuntu0.18.04.5","0.25-3.1ubuntu0.18.04.7","0.25-3.1ubuntu0.18.04.9","0.25-3.1ubuntu0.18.04.10","0.25-3.1ubuntu0.18.04.11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-8ubuntu2.7+esm1"}]}],"versions":["0.25-4ubuntu2","0.25-4ubuntu3","0.27.2-8ubuntu2","0.27.2-8ubuntu2.2","0.27.2-8ubuntu2.4","0.27.2-8ubuntu2.5","0.27.2-8ubuntu2.6","0.27.2-8ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-3ubuntu1.1"}]}],"versions":["0.27.3-3ubuntu4","0.27.3-3.1ubuntu1","0.27.5-1ubuntu1","0.27.5-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.6-1ubuntu0.1"}]}],"versions":["0.27.6-1","0.27.6-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.5+dfsg-1ubuntu0.1"}]}],"versions":["0.28.5+dfsg-1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"exiv2","product":"exiv2"}],"references":[{"url":"https://github.com/Exiv2/exiv2/issues/756","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://cwe.mitre.org/data/definitions/126.html","tags":["x_transferred","Technical Description","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202312-06","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-18771","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q7h8-cc9p-3543"},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787932207.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25884","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27596","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-18771","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-18771","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-18771","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8103-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-18899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-54080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-55304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-25884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-27596","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-27631","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-18771","description":"Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn_int.cpp which can result in an information leak.","status":"published","published":"2021-08-23T00:00:00Z","modified":"2024-11-18T21:43:21.259Z","updated_at":"2026-11-02T14:35:59.434367Z"}],"euvd":[{"id":"EUVD-2021-0075","description":"Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn_int.cpp which can result in an information leak.","status":"published","published":"2021-08-23T00:00:00Z","modified":"2024-11-18T21:43:21Z","updated_at":"2026-11-03T00:04:56.531722Z"}],"ghsa":[{"id":"GHSA-q7h8-cc9p-3543","title":"Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in...","description":"Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn_int.cpp which can result in an information leak.","status":"published","published":"2022-05-24T19:12:06Z","modified":"2023-12-22T12:31:44Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:55:16.323735Z"}],"nvd":[{"id":"CVE-2020-18771","description":"Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn_int.cpp which can result in an information leak.","status":"published","published":"2021-08-23T22:15:26.15Z","modified":"2026-06-17T02:59:28.403Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:06:45.704484Z"}],"osv":[{"id":"CVE-2020-18771","description":"Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn_int.cpp which can result in an information leak.","status":"published","published":"2021-08-23T22:15:26.15Z","modified":"2026-03-14T14:45:24.680721Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:15.212689Z"},{"id":"DEBIAN-CVE-2020-18771","description":"Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn_int.cpp which can result in an information leak.","status":"published","published":"2021-08-23T22:15:26.15Z","modified":"2026-10-26T12:01:42.792001495Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"PYSEC-2021-882","description":"Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn_int.cpp which can result in an information leak.","status":"withdrawn","published":"2021-08-23T22:15:00Z","modified":"2025-10-09T07:56:47.548803Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"UBUNTU-CVE-2020-18771","description":"Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn_int.cpp which can result in an information leak.","status":"published","published":"2021-08-23T22:15:00Z","modified":"2026-04-22T12:32:42.605287Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"CLSA-2026-1787932207","title":"Fix CVE(s): CVE-2020-18771, CVE-2026-25884, CVE-2026-27596","description":"   * SECURITY UPDATE: out-of-bounds read in the Nikon MakerNote printer\n     - debian/patches/CVE-2020-18771.patch: bound the nikonFocusarea[]\n       index in Nikon1MakerNote::print0x0088() with EXV_COUNTOF(), so a\n       crafted MakerNote cannot make the printer read a pointer from past\n       the end of the table (upstream 5e6c2855ce, via Debian DLA-3265-1).\n     - CVE-2020-18771\n   * SECURITY UPDATE: out-of-bounds read in the native preview loader\n     - debian/patches/CVE-2026-27596.patch: require sizeData \u003e= 28 in\n       LoaderNative::getData() before subtracting 28, so a Photoshop\n       preview IRB declaring a shorter payload cannot wrap the length to\n       nearly 4 GB (upstream 2cb728a850).\n     - CVE-2026-27596","status":"published","published":"2026-09-01T10:59:33Z","modified":"2026-10-26T09:32:03.72751459Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"DLA-3265-1","title":"exiv2 - security update","status":"published","published":"2023-01-10T00:00:00Z","modified":"2026-03-09T01:18:16.024502Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"USN-8103-1","title":"exiv2 vulnerabilities","description":"It was discovered that Exiv2 did not correctly handle reading certain\nbuffers. An attacker could possibly use this issue to leak sensitive\ninformation. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04\nLTS. (CVE-2020-18771)\n\nWen Cheng discovered that Exiv2 did not correctly handle certain memory\nallocation. If a user or system were tricked into opening a specially\ncrafted file, an attacker could possibly use this issue to cause a denial\nof service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.\n(CVE-2020-18899)\n\nIt was discovered that Exiv2 did not correctly handle writing certain\nmetadata. If a user or system were tricked into opening a specially crafted\nfile, an attacker could possibly use this issue to cause a denial of\nservice. (CVE-2025-54080)\n\nIt was discovered that Exiv2 did not correctly handle parsing certain\nmetadata. If a user or system were tricked into opening a specially crafted\nfile, an attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\nUbuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-55304)\n\nIt was discovered that Exiv2 did not correctly handle parsing certain\nimages. If a user or system were tricked into opening a specially crafted\nfile, an attacker could possibly use this issue to cause a denial of\nservice. (CVE-2026-25884)\n\nIt was discovered that Exiv2 did not correctly handle previewing certain\nimages. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2026-27596)\n\nIt was discovered that Exiv2 did not correctly handle certain integer\narithmetic. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2026-27631)","status":"published","published":"2026-03-18T02:55:39Z","modified":"2026-06-25T13:32:31.985637767Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}