exiv2 0.26 contains a Stack out of bounds read in webp parser
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-1000126.json"