CVE-2026-27596
Out-of-Bounds Read in Exiv2 Preview Causes Crash
Publication date: 2026-03-02
Last updated on: 2026-03-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| exiv2 | exiv2 | to 0.28.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
| CWE-191 | The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-27596 is an integer overflow vulnerability in the Exiv2 library, specifically in the LoaderNative::getData() function. This overflow leads to an out-of-bounds read in the preview component of Exiv2, which is triggered only when running the tool with an additional command line argument such as "-pp".'}, {'type': 'paragraph', 'content': 'The out-of-bounds read occurs at an offset of approximately 4GB, which usually causes the application to crash. The root cause is improper validation of data size before performing offset calculations, allowing integer underflow or overflow during processing of native preview data in EPS files.'}, {'type': 'paragraph', 'content': 'The vulnerability was fixed in version 0.28.8 by adding validation checks to ensure the data size is sufficient before offset calculations, preventing integer overflow and subsequent out-of-bounds reads.'}] [1, 2, 3, 4]
How can this vulnerability impact me? :
This vulnerability can cause the Exiv2 application or any software using the Exiv2 library to crash when processing specially crafted EPS files with preview data, due to an out-of-bounds read triggered by an integer overflow.
Such crashes can lead to denial of service conditions, potentially disrupting workflows or applications that rely on Exiv2 for image metadata processing.
There is no indication from the provided information that this vulnerability allows for code execution or data corruption beyond causing a crash.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability is triggered only when running the Exiv2 command-line utility with an extra argument such as "-pp" which activates the preview component. Detection involves running Exiv2 on potentially malicious or malformed EPS files that could trigger the integer overflow and out-of-bounds read.'}, {'type': 'paragraph', 'content': 'A practical detection method is to run the Exiv2 tool with the "-pp" argument on suspicious EPS files and observe if the application crashes or throws an error related to corrupted metadata.'}, {'type': 'paragraph', 'content': 'For example, you can use a command like:'}, {'type': 'list_item', 'content': 'exiv2 -pp <filename>.eps'}, {'type': 'paragraph', 'content': 'If the tool crashes or reports an error such as "$kerCorruptedMetadata", it indicates the presence of the vulnerability or malformed data triggering it.'}, {'type': 'paragraph', 'content': 'Additionally, running regression tests with the provided proof-of-concept EPS file (issue_3511_poc.eps) can help verify if your version of Exiv2 is vulnerable.'}] [1, 2, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The primary mitigation step is to upgrade Exiv2 to version 0.28.8 or later, where the vulnerability has been patched by adding validation checks to prevent integer overflow in the preview component.'}, {'type': 'paragraph', 'content': 'If upgrading immediately is not possible, avoid running Exiv2 with the "-pp" argument on untrusted or malformed EPS files, as this triggers the vulnerable code path.'}, {'type': 'paragraph', 'content': 'Also, consider restricting or monitoring the processing of EPS files from untrusted sources to reduce the risk of exploitation.'}] [1, 2, 3]