CVE-2026-25884

Name of the Vulnerable Software and Affected Versions Exiv2 versions prior to 0.28.8

Description Exiv2 is a C++ library and a command-line utility used for reading, writing, deleting, and modifying Exif, IPTC, XMP, and ICC image metadata. A flaw exists in the CRW image parser that can lead to an out-of-bounds read. The issue is present in the CrwMap::decode0x0805 function.

Recommendations Versions prior to 0.28.8 should be updated to version 0.28.8 or later.