CVE-2026-25884 Exiv2: Out-of-bounds read in CrwMap::decode0x0805

Low 2.7 Published 2 Mar 2026 Updated 2 Mar 2026

An out-of-bounds read in the CRW parser allows attackers to cause denial of service or disclose memory contents via crafted images.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-25884?

CVE-2026-25884 is a low-severity memory corruption vulnerability in Exiv2 Exiv2, published on 2 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found. The vulnerability is in the CRW image parser. This issue has been patched in version 0.28.8.

Weakness: CWE-125

Which versions are affected by CVE-2026-25884?

It affects 1 product.

Products include Exiv2 Exiv2.

How do I fix CVE-2026-25884?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-25884 being exploited?

There is no known exploitation of CVE-2026-25884 in the wild and no public exploit code.

All Exiv2 Exiv2 vulnerabilities

Sources

Also known as AZL-78524, AZL-78621, DEBIAN-CVE-2026-25884, GHSA-9mxq-4j5g-5wrp, JLSEC-2026-1316, UBUNTU-CVE-2026-25884 and 1 more.