Medium

An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns pValue_ to 0x0, and the value of pValue() is 0x0. TiffImageEntry::doWriteImage wil

Disclosed: 26.05.2017
Updated: 11.10.2026 12:19

An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns pValue_ to 0x0, and the value of pValue() is 0x0. TiffImageEntry::doWriteImage will use the value of pValue() to cause a segmentation fault. To exploit this vulnerability, someone must open a crafted tiff file.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Python (PyPI)	exiv2	all versions	no fix

References

CVSS score 6.5/10

CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness (CWE): -
Platform: Python (PyPI)
Package: exiv2
Disclosed: 26.05.2017
Updated: 11.10.2026 12:19

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2017-112 - PyPA Advisory Database; CC BY 4.0

Vulnerability history: exiv2

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (15) in the archive

Total entries: 15
First → latest: 05.2017 08.2025
Without a fix: 12
Exploited in attacks: 0

Severity breakdown

High 3
Medium 10
Low 2

Disclosures per year

2017: 1
2018: 4
2019: 1
2020: 0
2021: 2
2022: 0
2023: 2
2024: 2
2025: 3
2026: 0

06.11.2023

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds write was found in Exiv2 version v0.28.0. The vulnerable fu

High · 8.8 CVE-2023-44398 all versions no fix
22.08.2023

Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1 allows remote attackers to cause a denial of service and other unspecified impacts via use of crafted file.

High · 7.8 CVE-2020-18831 all versions no fix
26.07.2021

An integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap-based buffer overflow and cause a denial of service (DOS) via crafted metadata.

High · 7.5 CVE-2021-31292 all versions no fix
26.05.2017

An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns pValue_ to 0x0, and the value of pValue() is 0x0. TiffImageEntry::doWriteImage wil this entry

Medium · 6.5 CVE-2017-9239 all versions no fix

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application