GLSA 202603-01: Exiv2: Multiple Vulnerabilities

http://security.gentoo.org/

Severity:	low
Title:	Exiv2: Multiple Vulnerabilities
Date:	03/09/2026
Bugs:	#942164, #970828
ID:	202603-01

Synopsis

Multiple vulnerabilities have been found in Exiv2, the worst of which can lead to a crash via Denial of Service.

Background

Exiv2 is a C++ library and set of tools for parsing, editing and saving Exif and IPTC metadata from images.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
media-gfx/exiv2	< 0.28.8	>= 0.28.8	All supported architectures

Description

The following vulnerabilities have been discovered in Exiv2: 2 out of bounds reads, an integer overflow, and an uncaught exception. The worst of which can lead to a Denial of Service via a crash of the program. Please review the CVE identifiers referenced below for details.

Impact

The following is a possible outcome: data leakage via an out-of-bounds read or a Denial of Service via a crash of the program.

Workaround

Avoid using the CLI tool, exiv2, with untrusted files.

Resolution

All Exiv2 users should upgrade to the latest version:

          # emerge --sync
          # emerge --ask --oneshot --verbose ">=media-gfx/exiv2-0.28.8"

References

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-202603-01.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.