CVE-2026-27596

Name of the Vulnerable Software and Affected Versions Exiv2 versions prior to 0.28.8

Description Exiv2 is a C++ library and a command-line utility used to read, write, delete, and modify image metadata formats like Exif, IPTC, XMP, and ICC. A flaw exists in the preview component that can lead to an out-of-bounds read when Exiv2 is executed with an additional command-line argument, such as -pp. This out-of-bounds read occurs at a 4GB offset, typically resulting in a crash of the Exiv2 application. The LoaderNative::getData() function is implicated in this issue.

Recommendations Versions prior to 0.28.8 should be updated to version 0.28.8 or later.