CVE-2026-25884: Exiv2: Out-of-bounds read in CrwMap::decode0x0805
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found. The vulnerability is in the CRW image parser. This issue has been patched in version 0.28.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/exiv2to a version that resolves this vulnerability.Fixed in 0.28.9-r0 - Upgrade
Upgrade
Exiv2to a version that resolves this vulnerability.Fixed in 0.28.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25884?
CVE-2026-25884 is classified as a medium severity vulnerability due to an out-of-bounds read issue.
Which versions of Exiv2 are affected by CVE-2026-25884?
CVE-2026-25884 affects Exiv2 versions prior to 0.28.8.
How do I fix CVE-2026-25884?
To fix CVE-2026-25884, you need to upgrade Exiv2 to version 0.28.8 or later.
What type of vulnerability is CVE-2026-25884?
CVE-2026-25884 is an out-of-bounds read vulnerability found in the CRW image parser of the Exiv2 library.
Is there a workaround for CVE-2026-25884?
There are currently no official workarounds for CVE-2026-25884, and the recommended action is to upgrade the software.