CVE-2024-39695

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.2. The vulnerability is in the parser for the ASF video format, which was a new feature in v0.28.0. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted video file. The bug is fixed in version v0.28.3.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39695.json"
}

References

Affected packages

Git / github.com/exiv2/exiv2

Affected ranges

Type

GIT

Repo

https://github.com/exiv2/exiv2

Events

Introduced

931a40a746f5678dcc4625b06a2eb25fa4f00b34

Fixed

a6a79ef064f131ffd03c110acce2d3edb84ffa2e

Fixed

3a28346db5ae1735a8728fe3491b0aecc1dbf387

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0.28.0"
        },
        {
            "fixed": "0.28.3"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:exiv2:exiv2:*:*:*:*:*:*:*:*"
}

Affected versions

v0.*

v0.28.0

v0.28.1

v0.28.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-39695.json"

vanir_signatures

[
    {
        "target": {
            "function": "AsfVideo::decodeHeader",
            "file": "src/asfvideo.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/exiv2/exiv2/commit/3a28346db5ae1735a8728fe3491b0aecc1dbf387",
        "id": "CVE-2024-39695-1514c7b9",
        "signature_version": "v1",
        "digest": {
            "length": 462.0,
            "function_hash": "88257935135984982867312839615291411079"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "AsfVideo::streamProperties",
            "file": "src/asfvideo.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/exiv2/exiv2/commit/3a28346db5ae1735a8728fe3491b0aecc1dbf387",
        "id": "CVE-2024-39695-6194433b",
        "signature_version": "v1",
        "digest": {
            "length": 796.0,
            "function_hash": "105428784746860063348776894588523176421"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "AsfVideo::HeaderReader::HeaderReader",
            "file": "src/asfvideo.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/exiv2/exiv2/commit/3a28346db5ae1735a8728fe3491b0aecc1dbf387",
        "id": "CVE-2024-39695-90b89573",
        "signature_version": "v1",
        "digest": {
            "length": 284.0,
            "function_hash": "197739322505638074381697842375351231248"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "src/asfvideo.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/exiv2/exiv2/commit/3a28346db5ae1735a8728fe3491b0aecc1dbf387",
        "id": "CVE-2024-39695-cb6cc373",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "13709010422328940566935468869600840908",
                "138267457726336358452953641749099982036",
                "32756204079311668524520428415165430453",
                "163390997209723102112502485388277307790",
                "256408642367862661417005747270226218651",
                "247493202791271579436704242321447121037",
                "116340123415061569803052037942618544871",
                "220676755723957842662119383124569319949",
                "89245176066610528953585745847721665783",
                "107507256365929353274579992926613901568",
                "112669508820060460455340539953948510540",
                "2998631293118311015131258849003353552",
                "145935274615714093797826044317601517716",
                "171555698996535444213340730528565332896",
                "334579226884254530013434655253375999433",
                "198869315890836333941229801748849961187"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "AsfVideo::fileProperties",
            "file": "src/asfvideo.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/exiv2/exiv2/commit/3a28346db5ae1735a8728fe3491b0aecc1dbf387",
        "id": "CVE-2024-39695-ff6319bb",
        "signature_version": "v1",
        "digest": {
            "length": 661.0,
            "function_hash": "129008512560735208213800617324848643838"
        },
        "signature_type": "Function"
    }
]

vanir_signatures_modified

"2026-08-12T15:13:04Z"