CVE-2026-25884— Exiv2: Out-of-bounds read in CrwMap::decode0x0805
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-25884
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Exiv2: Out-of-bounds read in CrwMap::decode0x0805
Source: NVD (National Vulnerability Database)
Vulnerability Description
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found. The vulnerability is in the CRW image parser. This issue has been patched in version 0.28.8.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
跨界内存读
Source: NVD (National Vulnerability Database)
Vulnerability Title
Exiv2 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Exiv2是Andreas Huggel个人开发者的一套用于管理图像元数据的C++库和命令行应用程序。该产品提供了读取和写入EXIF、IPTC和XMP等多种格式图像元数据的功能。 Exiv2 0.28.8之前版本存在缓冲区错误漏洞，该漏洞源于CRW图像解析器存在越界读取。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-25884
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-25884
请登录查看更多情报信息。
- Out-of-bounds read in CrwMap::decode0x0805 · Advisory · Exiv2/exiv2 · GitHubx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-25884
Same Patch Batch · Exiv2 · 2026-03-02 · 3 CVEs total
| CVE-2026-27596 | Exiv2: Integer Underflow in LoaderNative::getData() Causes Heap Buffer Overflow | |
| CVE-2026-27631 | Exiv2: Uncaught exception - cannot create std::vector larger than max_size() |
IV. Related Vulnerabilities
Same product: exiv2
- CVE-2026-27596
Exiv2: Integer Underflow in LoaderNative::getData() Causes H - CVE-2026-27631
Exiv2: Uncaught exception - cannot create std::vector larger - CVE-2025-55304
Exiv2 has quadratic performance in ICC profile parsing in Jp - CVE-2025-54080
Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata( - CVE-2025-26623
Use After Free in Exiv2
Same vendor: Exiv2
- CVE-2026-27596
Exiv2: Integer Underflow in LoaderNative::getData() Causes H - CVE-2026-27631
Exiv2: Uncaught exception - cannot create std::vector larger - CVE-2025-55304
Exiv2 has quadratic performance in ICC profile parsing in Jp - CVE-2025-54080
Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata( - CVE-2025-26623
Use After Free in Exiv2
Same weakness: CWE-125
- CVE-2026-8177
XML::LibXML versions through 2.0210 for Perl read out-of-bou - CVE-2026-6104
Global buffer over-read in mb_convert_encoding() with attack - CVE-2026-7258
Out-of-bounds read in urldecode() on NetBSD - CVE-2026-8186
Open5GS NF client.c ogs_sbi_client_send_via_scp_or_sepp out- - CVE-2026-3508
ASUS System Control Interface 缓冲区错误漏洞
V. Comments for CVE-2026-25884
No comments yet