Medium

Exiv2 has an out-of-bounds read in QuickTimeVideo::NikonTagsDecoder

Disclosed: 12.02.2024
Updated: 11.10.2026 15:17

Impact

An out-of-bounds read was found in Exiv2 version v0.28.1. The vulnerable function, QuickTimeVideo::NikonTagsDecoder, was new in v0.28.0 (see https://github.com/Exiv2/exiv2/pull/2337), so Exiv2 versions before v0.28 are not affected. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted video file.

Patches

The bug is fixed in version v0.28.2.

For more information

Please see our security policy for information about Exiv2 security.

Credit

This bug was found by OSS-Fuzz.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Python (PyPI)	exiv2	>= 0.16.0, < 0.16.1	0.16.1

References

CVSS score 5.5/10

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-125
Platform: Python (PyPI)
Package: exiv2
Disclosed: 12.02.2024
Updated: 11.10.2026 15:17

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2024-106 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-g9xm-7538-mq8w - CC BY 4.0

Vulnerability history: exiv2

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (15) in the archive

Total entries: 15
First → latest: 05.2017 08.2025
Without a fix: 12
Exploited in attacks: 0

Severity breakdown

High 3
Medium 10
Low 2

Disclosures per year

2017: 1
2018: 4
2019: 1
2020: 0
2021: 2
2022: 0
2023: 2
2024: 2
2025: 3
2026: 0

12.02.2024

Exiv2 has an out-of-bounds read in QuickTimeVideo::NikonTagsDecoder this entry

Medium · 5.5 CVE-2024-24826 >= 0.16.0, < 0.16.1 0.16.1
06.11.2023

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds write was found in Exiv2 version v0.28.0. The vulnerable fu

High · 8.8 CVE-2023-44398 all versions no fix
22.08.2023

Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1 allows remote attackers to cause a denial of service and other unspecified impacts via use of crafted file.

High · 7.8 CVE-2020-18831 all versions no fix
26.07.2021

An integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap-based buffer overflow and cause a denial of service (DOS) via crafted metadata.

High · 7.5 CVE-2021-31292 all versions no fix

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application