p PatchFirst

CVE-2026-27631

CVE-2026-27631 · Exiv2: Uncaught exception - cannot create std::vector larger than max_size()

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught exception was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. Due to an integer overflow, the code attempts to create a huge std::vector, which causes Exiv2 to crash with an uncaught exception. This issue has been patched in version 0.28.8.

CVSS 2.7 · Low · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • exiv2

    Versions
    • < 0.28.8: Affected

    No fix published

  • exiv2 Debian:12

    Versions
    • 0.27.6-1
    • 0.28.0+dfsg-1
    • 0.28.0+dfsg-2
    • 0.28.0+dfsg-3
    • 0.28.0+dfsg-4
    • 0.28.1+dfsg-1
    • 0.28.1+dfsg-2
    • 0.28.1+dfsg-3
    • 0.28.2+dfsg-1
    • 0.28.3+dfsg-1
    • 0.28.3+dfsg-2
    • 0.28.4+dfsg-1
    • 0.28.4+dfsg-2
    • 0.28.5+dfsg-1
    • 0.28.7+dfsg-1
    • 0.28.7+dfsg-2
    • 0.28.8+dfsg-1
    • 0.28.9+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • exiv2 Debian:13

    Versions
    • 0.28.5+dfsg-1
    • 0.28.7+dfsg-1
    • 0.28.7+dfsg-2
    • 0.28.8+dfsg-1
    • 0.28.9+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • exiv2 Debian:14

    Versions
    • 0.28.5+dfsg-1
    • 0.28.7+dfsg-1
    • 0.28.7+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 0.28.8+dfsg-1

    Update to 0.28.8+dfsg-1

  • exiv2 Ubuntu:Pro:16.04:LTS

    Versions
    • 0.25-1ubuntu1
    • 0.25-2.1
    • 0.25-2.1ubuntu16.04.1
    • 0.25-2.1ubuntu16.04.2
    • 0.25-2.1ubuntu16.04.3
    • 0.25-2.1ubuntu16.04.4
    • 0.25-2.1ubuntu16.04.5
    • 0.25-2.1ubuntu16.04.6
    • 0.25-2.1ubuntu16.04.7+esm1
    • 0.25-2.1ubuntu16.04.7+esm2
    • 0.25-2.1ubuntu16.04.7+esm3
    • 0.25-2.1ubuntu16.04.7+esm4
    Affected ranges
    • ECOSYSTEM: < 0.25-2.1ubuntu16.04.7+esm5

    Update to 0.25-2.1ubuntu16.04.7+esm5

  • exiv2 Ubuntu:Pro:18.04:LTS

    Versions
    • 0.25-3.1
    • 0.25-3.1ubuntu0.18.04.1
    • 0.25-3.1ubuntu0.18.04.2
    • 0.25-3.1ubuntu0.18.04.3
    • 0.25-3.1ubuntu0.18.04.4
    • 0.25-3.1ubuntu0.18.04.5
    • 0.25-3.1ubuntu0.18.04.7
    • 0.25-3.1ubuntu0.18.04.9
    • 0.25-3.1ubuntu0.18.04.10
    • 0.25-3.1ubuntu0.18.04.11
    Affected ranges
    • ECOSYSTEM: < 0.25-3.1ubuntu0.18.04.11+esm1

    Update to 0.25-3.1ubuntu0.18.04.11+esm1

  • exiv2 Ubuntu:Pro:20.04:LTS

    Versions
    • 0.25-4ubuntu2
    • 0.25-4ubuntu3
    • 0.27.2-8ubuntu2
    • 0.27.2-8ubuntu2.2
    • 0.27.2-8ubuntu2.4
    • 0.27.2-8ubuntu2.5
    • 0.27.2-8ubuntu2.6
    • 0.27.2-8ubuntu2.7
    Affected ranges
    • ECOSYSTEM: < 0.27.2-8ubuntu2.7+esm1

    Update to 0.27.2-8ubuntu2.7+esm1

  • exiv2 Ubuntu:22.04:LTS

    Versions
    • 0.27.3-3ubuntu4
    • 0.27.3-3.1ubuntu1
    • 0.27.5-1ubuntu1
    • 0.27.5-3ubuntu1
    Affected ranges
    • ECOSYSTEM: < 0.27.5-3ubuntu1.1

    Update to 0.27.5-3ubuntu1.1

  • exiv2 Ubuntu:24.04:LTS

    Versions
    • 0.27.6-1
    • 0.27.6-1build1
    Affected ranges
    • ECOSYSTEM: < 0.27.6-1ubuntu0.1

    Update to 0.27.6-1ubuntu0.1

  • exiv2 Ubuntu:25.10

    Versions
    • 0.28.5+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 0.28.5+dfsg-1ubuntu0.1

    Update to 0.28.5+dfsg-1ubuntu0.1

Original sources

Check your server →