Log in Start free

Vulnerability · Published Mar 2, 2026 · Assigned by GitHub_M

CVE-2026-27631Exiv2: Uncaught exception - cannot create std::vector larger than max_size()

Low 2.7

In plain English

A low-severity security flaw in exiv2 from Exiv2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.7Low
Exploit odds (30 days)0.3%top 78.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught exception was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. Due to an integer overflow, the code attempts to create a huge std::vector, which causes Exiv2 to crash with an uncaught exception. This issue has been patched in version 0.28.8.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24exiv20.28.9-r0ALPINE-CVE-2026-27631
Debian:12exiv2no fix listedDEBIAN-CVE-2026-27631
Debian:13exiv2no fix listedDEBIAN-CVE-2026-27631
Debian:14exiv20.28.8+dfsg-1DEBIAN-CVE-2026-27631
Ubuntu:22.04:LTSexiv20.27.5-3ubuntu1.1UBUNTU-CVE-2026-27631
Ubuntu:24.04:LTSexiv20.27.6-1ubuntu0.1UBUNTU-CVE-2026-27631
Ubuntu:25.10exiv20.28.5+dfsg-1ubuntu0.1UBUNTU-CVE-2026-27631

Affected products (as reported)

VendorProductVersions
Exiv2 exiv2 < 0.28.8

Weakness: CWE-248 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

References