CVE-2018-12264

Name of the Vulnerable Software and Affected Versions Exiv2 version 0.26

Description The issue is caused by integer overflows in the LoaderTiff::getData() function in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea in value.hpp. This can allow a remote attacker to execute arbitrary code by exploiting the buffer overflow vulnerability in the Exiv2 library for media file metadata management.

Recommendations For Exiv2 version 0.26, consider disabling the LoaderTiff::getData() function as a temporary workaround until a patch is available. Restrict access to the preview.cpp module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.