CVE-2026-27631 Exiv2: Uncaught exception - cannot create std::vector larger than max_size()
An integer overflow in Exiv2 causes a crash when processing preview images with specific command-line arguments, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27631?
CVE-2026-27631 is a low-severity vulnerability in Exiv2 Exiv2, published on 2 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught exception was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. Due to an integer overflow, the code attempts to create a huge std::vector, which causes Exiv2 to crash with an uncaught exception. This issue has been patched in version 0.28.8.
Weakness: CWE-248
Which versions are affected by CVE-2026-27631?
It affects 1 product.
Products include Exiv2 Exiv2.
How do I fix CVE-2026-27631?
Upgrade to a fixed version.
Is CVE-2026-27631 being exploited?
There is no known exploitation of CVE-2026-27631 in the wild and no public exploit code.
Other vulnerabilities in Exiv2 Exiv2
Sources
Also known as AZL-78527, AZL-78627, CLSA-2026-1775221560, CLSA-2026-1777455968, DEBIAN-CVE-2026-27631, GHSA-p2pw-7935-c73j and 1 more.