CVE-2021-29463

Name of the Vulnerable Software and Affected Versions Exiv2 versions v0.27.3 and earlier

Description An out-of-bounds read was found in Exiv2 when used to write metadata into a crafted image file. This could potentially be exploited by an attacker to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. The bug is only triggered when writing metadata, which is a less frequently used operation than reading metadata.

Recommendations For Exiv2 versions v0.27.3 and earlier, update to version v0.27.4 to resolve the issue. As a temporary workaround, consider avoiding the use of the insert command-line argument when running the Exiv2 command-line application, to minimize the risk of exploitation.