# cve.now: Exiv2

The newest entries naming Exiv2 as an affected vendor (up to 200), of 29 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-25884](https://cve.now/CVE-2026-25884.md): Exiv2: Out-of-bounds read in CrwMap::decode0x0805 (CVSS 2.7)
- [CVE-2026-27596](https://cve.now/CVE-2026-27596.md): Exiv2: Integer Underflow in LoaderNative::getData() Causes Heap Buffer Overflow (CVSS 2.7)
- [CVE-2026-27631](https://cve.now/CVE-2026-27631.md): Exiv2: Uncaught exception - cannot create std::vector larger than max\_size() (CVSS 2.7)
- [CVE-2025-55304](https://cve.now/CVE-2025-55304.md): Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata (CVSS 1.8)
- [CVE-2025-54080](https://cve.now/CVE-2025-54080.md): Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file (CVSS 1.8)
- [CVE-2025-26623](https://cve.now/CVE-2025-26623.md): Use After Free in Exiv2 (CVSS 5.3)
- [CVE-2024-39695](https://cve.now/CVE-2024-39695.md): Exiv2 has an out-of-bounds read in AsfVideo::streamProperties (CVSS 5.3)
- [CVE-2024-24826](https://cve.now/CVE-2024-24826.md): Out-of-bounds read in QuickTimeVideo::NikonTagsDecoder in Exiv2 (CVSS 5.5)
- [CVE-2024-25112](https://cve.now/CVE-2024-25112.md): Denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder in Exiv2 (CVSS 5.5)
- [CVE-2023-44398](https://cve.now/CVE-2023-44398.md): Out-of-bounds write in exiv2 (CVSS 8.8)
- [CVE-2021-37623](https://cve.now/CVE-2021-37623.md): Denial of service due to infinite loop in JpegBase::printStructure (#2) (CVSS 5.5)
- [CVE-2021-37622](https://cve.now/CVE-2021-37622.md): Denial of service due to infinite loop in JpegBase::printStructure (#1) (CVSS 5.5)
- [CVE-2021-37621](https://cve.now/CVE-2021-37621.md): Denial of service due to infinite loop in Image::printIFDStructure (CVSS 5.5)
- [CVE-2021-37620](https://cve.now/CVE-2021-37620.md): Out-of-bounds read in XmpTextValue::read() (CVSS 4.7)
- [CVE-2021-37619](https://cve.now/CVE-2021-37619.md): Out-of-bounds read in Exiv2::Jp2Image::encodeJp2Header (CVSS 4.7)
- [CVE-2021-37618](https://cve.now/CVE-2021-37618.md): Out-of-bounds read in Exiv2::Jp2Image::printStructure (CVSS 4.7)
- [CVE-2021-37616](https://cve.now/CVE-2021-37616.md): Null pointer dereference in Exiv2::Internal::resolveLens0x8ff (CVSS 5.5)
- [CVE-2021-37615](https://cve.now/CVE-2021-37615.md): Null pointer dereference in Exiv2::Internal::resolveLens0x319 (CVSS 4.7)
- [CVE-2021-34335](https://cve.now/CVE-2021-34335.md): Denial of service due to FPE in Exiv2::Internal::resolveLens0xffff (CVSS 4.7)
- [CVE-2021-34334](https://cve.now/CVE-2021-34334.md): Denial of service due to integer overflow in loop counter (CVSS 5.5)
- [CVE-2021-32815](https://cve.now/CVE-2021-32815.md): Denial of service due to assertion failure in crwimage\_int.cpp (CVSS 5.5)
- [CVE-2021-32617](https://cve.now/CVE-2021-32617.md): Denial of service in Exiv2 (CVSS 4.7)
- [CVE-2021-29623](https://cve.now/CVE-2021-29623.md): Uninitialized variable bug in Exiv2 (CVSS 3.6)
- [CVE-2021-29464](https://cve.now/CVE-2021-29464.md): Heap buffer overflow in Exiv2::Jp2Image::encodeJp2Header (CVSS 3.3)
- [CVE-2021-29463](https://cve.now/CVE-2021-29463.md): Out-of-bounds read in Exiv2::WebPImage::doWriteMetadata (CVSS 3.3)
- [CVE-2021-29473](https://cve.now/CVE-2021-29473.md): Out-of-bounds read in Exiv2::Jp2Image::doWriteMetadata (CVSS 2.5)
- [CVE-2021-29470](https://cve.now/CVE-2021-29470.md): Out-of-bounds read in Exiv2::Jp2Image::encodeJp2Header (CVSS 4.7)
- [CVE-2021-29458](https://cve.now/CVE-2021-29458.md): Out-of-bounds read in Exiv2::Internal::CrwMap::encode (no CVSS)
- [CVE-2021-29457](https://cve.now/CVE-2021-29457.md): Heap buffer overflow in Exiv2::Jp2Image::doWriteMetadata (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/exiv2
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.