{"id":"CVE-2026-68546","aliases":["DEBIAN-CVE-2026-68546","MGASA-2026-0379","OESA-2026-3888","OESA-2026-3889","OESA-2026-3890","OESA-2026-3891","OESA-2026-4088","SUSE-SU-2026:23860-1","SUSE-SU-2026:23871-1","SUSE-SU-2026:4374-1","UBUNTU-CVE-2026-68546","openSUSE-SU-2026:11658-1","openSUSE-SU-2026:21904-1"],"status":"published","title":"Updated exiv2 package fixes security vulnerabilities","description":"Heap out-of-bounds write in RemoteIo when reading from a malicious\nremote server (WebReady/Curl builds). (CVE-2026-68546)\nHeap out-of-bounds read in RemoteIo when reading block-aligned remote\nCRW files. (CVE-2026-68547)\nOut of bounds read in CrwMap::decodeBasic. (CVE-2026-49275)","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-09-01T00:00:00Z","modified":"2026-10-17T12:59:25Z","fixes":[{"ecosystem":"Debian:14","package":"exiv2","fixed_in":["0.28.9+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.27.6-1","0.28.0+dfsg-1","0.28.0+dfsg-2","0.28.0+dfsg-3","0.28.0+dfsg-4","0.28.1+dfsg-1","0.28.1+dfsg-2","0.28.1+dfsg-3","0.28.2+dfsg-1","0.28.3+dfsg-1","0.28.3+dfsg-2","0.28.4+dfsg-1","0.28.4+dfsg-2","0.28.5+dfsg-1","0.28.7+dfsg-1","0.28.7+dfsg-2","0.28.8+dfsg-1","0.28.9+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28.5+dfsg-1","0.28.7+dfsg-1","0.28.7+dfsg-2","0.28.8+dfsg-1","0.28.9+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.9+dfsg-1"}]}],"versions":["0.28.5+dfsg-1","0.28.7+dfsg-1","0.28.7+dfsg-2","0.28.8+dfsg-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.9-1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-8.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-8.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.2-10.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.2-10.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.2-10.oe2403sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.9-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.9-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.9-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.9-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-150400.15.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-150400.15.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-150400.15.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-150400.15.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-150400.15.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-150400.15.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-150400.15.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-150400.15.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-150400.15.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-150400.15.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-150400.15.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.25-1ubuntu1","0.25-2.1","0.25-2.1ubuntu16.04.1","0.25-2.1ubuntu16.04.2","0.25-2.1ubuntu16.04.3","0.25-2.1ubuntu16.04.4","0.25-2.1ubuntu16.04.5","0.25-2.1ubuntu16.04.6","0.25-2.1ubuntu16.04.7+esm1","0.25-2.1ubuntu16.04.7+esm2","0.25-2.1ubuntu16.04.7+esm3","0.25-2.1ubuntu16.04.7+esm4","0.25-2.1ubuntu16.04.7+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.25-3.1","0.25-3.1ubuntu0.18.04.1","0.25-3.1ubuntu0.18.04.2","0.25-3.1ubuntu0.18.04.3","0.25-3.1ubuntu0.18.04.4","0.25-3.1ubuntu0.18.04.5","0.25-3.1ubuntu0.18.04.7","0.25-3.1ubuntu0.18.04.9","0.25-3.1ubuntu0.18.04.10","0.25-3.1ubuntu0.18.04.11","0.25-3.1ubuntu0.18.04.11+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.25-4ubuntu2","0.25-4ubuntu3","0.27.2-8ubuntu2","0.27.2-8ubuntu2.2","0.27.2-8ubuntu2.4","0.27.2-8ubuntu2.5","0.27.2-8ubuntu2.6","0.27.2-8ubuntu2.7","0.27.2-8ubuntu2.7+esm1","0.27.2-8ubuntu2.7+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.27.3-3ubuntu4","0.27.3-3.1ubuntu1","0.27.5-1ubuntu1","0.27.5-3ubuntu1","0.27.5-3ubuntu1.1","0.27.5-3ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.27.6-1","0.27.6-1build1","0.27.6-1ubuntu0.1","0.27.6-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28.8+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28.5+dfsg-1","0.28.7+dfsg-2","0.28.8+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.9-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.9-160000.1.1"}]}],"bundled":3}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2026-68546","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0379.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36221","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/30/1","tags":["web"]},{"url":"https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52","tags":["advisory","report"]},{"url":"https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j","tags":["advisory"]},{"url":"https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649","tags":["advisory"]},{"url":"https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q","tags":["advisory"]},{"url":"https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2","tags":["advisory"]},{"url":"https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp","tags":["advisory"]},{"url":"https://github.com/Exiv2/exiv2/security/advisories/GHSA-pwvq-9w4q-786w","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3888","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49275","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68547","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3889","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3890","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3891","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4088","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623860-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1277579","tags":["report"]},{"url":"https://bugzilla.suse.com/1277591","tags":["report"]},{"url":"https://bugzilla.suse.com/1277791","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68547","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623871-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264374-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-68546","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68546","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"osv":[{"id":"OESA-2026-3888","title":"exiv2 security update","description":"Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.\r\n\r\nSecurity Fix(es):\n\nExiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275)\n\nExiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546)\n\nExiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.(CVE-2026-68547)","status":"published","published":"2026-09-20T13:22:56Z","modified":"2026-09-20T13:30:22.797110996Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3889","title":"exiv2 security update","description":"Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.\r\n\r\nSecurity Fix(es):\n\nExiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275)\n\nExiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546)\n\nExiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.(CVE-2026-68547)","status":"published","published":"2026-09-20T13:22:56Z","modified":"2026-09-20T13:30:22.789448514Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3890","title":"exiv2 security update","description":"Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.\r\n\r\nSecurity Fix(es):\n\nExiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275)\n\nExiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546)\n\nExiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.(CVE-2026-68547)","status":"published","published":"2026-09-20T13:22:57Z","modified":"2026-09-20T13:30:22.790717456Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3891","title":"exiv2 security update","description":"Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.\r\n\r\nSecurity Fix(es):\n\nExiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275)\n\nExiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546)\n\nExiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.(CVE-2026-68547)","status":"published","published":"2026-09-20T13:22:57Z","modified":"2026-09-20T13:30:22.791594524Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4088","title":"exiv2 security update","description":"Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.\r\n\r\nSecurity Fix(es):\n\nExiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275)\n\nExiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546)\n\nExiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.(CVE-2026-68547)","status":"published","published":"2026-09-25T01:28:16Z","modified":"2026-09-25T01:45:12.241761265Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"DEBIAN-CVE-2026-68546","status":"published","published":"2026-09-05T10:47:33.287703192Z","modified":"2026-09-07T22:04:55.827552152Z","updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"MGASA-2026-0379","title":"Updated exiv2 package fixes security vulnerabilities","description":"Heap out-of-bounds write in RemoteIo when reading from a malicious\nremote server (WebReady/Curl builds). (CVE-2026-68546)\nHeap out-of-bounds read in RemoteIo when reading block-aligned remote\nCRW files. (CVE-2026-68547)\nOut of bounds read in CrwMap::decodeBasic. (CVE-2026-49275)\n","status":"published","published":"2026-09-07T18:46:11Z","modified":"2026-09-08T12:41:40.777015082Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11658-1","title":"exiv2-0.28.9-1.1 on GA media","description":"These are all security issues fixed in the exiv2-0.28.9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-01T00:00:00Z","modified":"2026-09-02T11:15:03.874912895Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21904-1","title":"Security update for exiv2","description":"This update for exiv2 fixes the following issues:\n\n- CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic (bsc#1277791).\n- CVE-2026-68546: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files (bsc#1277579).\n- CVE-2026-68547: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (bsc#1277591).\n\nChanges for exiv2:\n\n- update to 0.28.9:\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-pwvq-9w4q-786w\n","status":"published","published":"2026-09-22T07:22:00Z","modified":"2026-09-25T18:23:12.430594091Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23860-1","title":"Security update for exiv2","description":"This update for exiv2 fixes the following issues:\n\n- CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic (bsc#1277791).\n- CVE-2026-68546: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files (bsc#1277579).\n- CVE-2026-68547: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (bsc#1277591).\n\nChanges for exiv2:\n\n- update to 0.28.9:\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-pwvq-9w4q-786w\n","status":"published","published":"2026-09-22T07:21:58Z","modified":"2026-09-27T18:23:16.135903575Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23871-1","title":"Security update for exiv2","description":"This update for exiv2 fixes the following issues:\n\n- CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic (bsc#1277791).\n- CVE-2026-68546: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files (bsc#1277579).\n- CVE-2026-68547: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (bsc#1277591).\n\nChanges for exiv2:\n\n- update to 0.28.9:\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp\n * https://github.com/Exiv2/exiv2/security/advisories/GHSA-pwvq-9w4q-786w\n","status":"published","published":"2026-09-22T07:21:58Z","modified":"2026-09-27T18:23:17.187758902Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4374-1","title":"Security update for exiv2","description":"This update for exiv2 fixes the following issues:\n\n- CVE-2026-49275: out of bounds read in CrwMap::decodeBasic (bsc#1277791).\n- CVE-2026-68546: heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files (bsc#1277579).\n- CVE-2026-68547: heap out-of-bounds write in RemoteIo when reading from a malicious remote server (bsc#1277591).\n","status":"published","published":"2026-09-28T15:14:49Z","modified":"2026-09-29T09:15:10.895723118Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"UBUNTU-CVE-2026-68546","description":"[GHSA-3695-mjv8-3r52: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (WebReady/Curl builds)]","status":"published","published":"2026-09-07T00:00:00Z","modified":"2026-10-17T12:59:25.724284911Z","updated_at":"2026-11-02T16:56:57.159276Z"}]}}