OESA-2026-3890

Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.

Security Fix(es):

Exiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275)

Exiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546)

Exiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.(CVE-2026-68547)