CVE-2023-44398

Name of the Vulnerable Software and Affected Versions Exiv2 version v0.28.0

Description The issue is related to an out-of-bounds write in the BmffImage::brotliUncompress() function of the Exiv2 library, which can be triggered when reading the metadata of a crafted image file. This could potentially allow a remote attacker to execute arbitrary code if they can trick the victim into running Exiv2 on a maliciously crafted image file.

Recommendations For Exiv2 version v0.28.0, upgrade to version v0.28.1 to fix the issue. As a temporary workaround, consider avoiding the use of the BmffImage::brotliUncompress() function until the patch is applied. Restrict access to crafted image files to minimize the risk of exploitation.