CVE-2026-25884: Exiv2: Out-of-bounds read in CrwMap::decode0x0805

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-02 · updated 2026-06-17
Weakness: CWE-125

Description

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found. The vulnerability is in the CRW image parser. This issue has been patched in version 0.28.8.

Affected products

exiv2: before 0.28.8 — fixed in 0.28.8

How to fix

Upgrade to a fixed version: exiv2 0.28.8. Check the vendor advisory for mitigations.

References

https://github.com/Exiv2/exiv2/commit/cbba4d206512fe63e12d164fdd1881562f072a9d
https://github.com/Exiv2/exiv2/pull/3462
https://github.com/Exiv2/exiv2/security/advisories/GHSA-9mxq-4j5g-5wrp

Get alerted when CVE-2026-25884 or the next vulnerability affects your stack