CVE-2026-27631 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2026-27631 Interim 1 1 2026-03-05T00:15:03Z current 2026-03-05T00:15:03Z 2026-03-05T00:15:03Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2026-27631 Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught exception was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. Due to an integer overflow, the code attempts to create a huge std::vector, which causes Exiv2 to crash with an uncaught exception. This issue has been patched in version 0.28.8. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Server 15 SP5-LTSS SUSE Linux Enterprise Server 15 SP6-LTSS SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server Teradata 12 SP3 SUSE Linux Enterprise Server Teradata 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP6 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server for SAP applications 16.0 openSUSE Leap 15.6 exiv2 exiv2-0_26 exiv2-lang libexiv2-12 libexiv2-26 libexiv2-26-32bit libexiv2-27 libexiv2-27-32bit libexiv2-28 libexiv2-28-x86-64-v3 libexiv2-devel libexiv2-xmp-static libexiv2-27 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS libexiv2-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS libexiv2-xmp-static as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS exiv2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS libexiv2-26 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS exiv2-0_26 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS libexiv2-27 as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS libexiv2-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS libexiv2-xmp-static as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS exiv2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS libexiv2-27 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7 libexiv2-devel as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7 libexiv2-xmp-static as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7 exiv2 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP7 libexiv2-12 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS exiv2 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS libexiv2-12 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS exiv2 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libexiv2-12 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS libexiv2-devel as a component of SUSE Linux Enterprise Server 12 SP5-LTSS exiv2 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS exiv2 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security libexiv2-26 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libexiv2-devel as a component of SUSE Linux Enterprise Server 15 SP1-LTSS exiv2 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libexiv2-26 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS libexiv2-devel as a component of SUSE Linux Enterprise Server 15 SP2-LTSS exiv2 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS libexiv2-26 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS libexiv2-devel as a component of SUSE Linux Enterprise Server 15 SP3-LTSS exiv2 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS libexiv2-27 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS libexiv2-devel as a component of SUSE Linux Enterprise Server 15 SP4-LTSS libexiv2-xmp-static as a component of SUSE Linux Enterprise Server 15 SP4-LTSS exiv2 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS libexiv2-26 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS exiv2-0_26 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS libexiv2-27 as a component of SUSE Linux Enterprise Server 15 SP5-LTSS libexiv2-devel as a component of SUSE Linux Enterprise Server 15 SP5-LTSS libexiv2-xmp-static as a component of SUSE Linux Enterprise Server 15 SP5-LTSS exiv2 as a component of SUSE Linux Enterprise Server 15 SP5-LTSS libexiv2-27 as a component of SUSE Linux Enterprise Server 15 SP6-LTSS libexiv2-devel as a component of SUSE Linux Enterprise Server 15 SP6-LTSS libexiv2-xmp-static as a component of SUSE Linux Enterprise Server 15 SP6-LTSS exiv2 as a component of SUSE Linux Enterprise Server 15 SP6-LTSS libexiv2-28 as a component of SUSE Linux Enterprise Server 16.0 libexiv2-28-x86-64-v3 as a component of SUSE Linux Enterprise Server 16.0 exiv2 as a component of SUSE Linux Enterprise Server 16.0 exiv2 as a component of SUSE Linux Enterprise Server Teradata 12 SP3 exiv2 as a component of SUSE Linux Enterprise Server Teradata 15 SP4 exiv2-0_26 as a component of SUSE Linux Enterprise Server Teradata 15 SP4 libexiv2-27 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 libexiv2-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 libexiv2-xmp-static as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 exiv2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 libexiv2-26 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 exiv2-0_26 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 libexiv2-27 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 libexiv2-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 libexiv2-xmp-static as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 exiv2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 libexiv2-27 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 libexiv2-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 libexiv2-xmp-static as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 exiv2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 libexiv2-28 as a component of SUSE Linux Enterprise Server for SAP applications 16.0 libexiv2-28-x86-64-v3 as a component of SUSE Linux Enterprise Server for SAP applications 16.0 exiv2 as a component of SUSE Linux Enterprise Server for SAP applications 16.0 exiv2 as a component of openSUSE Leap 15.6 exiv2-lang as a component of openSUSE Leap 15.6 libexiv2-27 as a component of openSUSE Leap 15.6 libexiv2-27-32bit as a component of openSUSE Leap 15.6 libexiv2-devel as a component of openSUSE Leap 15.6 libexiv2-xmp-static as a component of openSUSE Leap 15.6 libexiv2-26 as a component of openSUSE Leap 15.6 libexiv2-26-32bit as a component of openSUSE Leap 15.6 exiv2-0_26 as a component of openSUSE Leap 15.6 Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught exception was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. Due to an integer overflow, the code attempts to create a huge std::vector, which causes Exiv2 to crash with an uncaught exception. This issue has been patched in version 0.28.8. CVE-2026-27631 moderate 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H