CVE-2024-24826 — MEDIUM (5.5)

Vulnerability Description

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.1. The vulnerable function, `QuickTimeVideo::NikonTagsDecoder`, was new in v0.28.0, so Exiv2 versions before v0.28 are _not_ affected. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted video file. In most cases this out of bounds read will result in a crash. This bug is fixed in version v0.28.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Exiv2	Exiv2	0.28.0

Related Weaknesses (CWE)

CWE-125

References

https://github.com/Exiv2/exiv2/pull/2337Patch
https://github.com/Exiv2/exiv2/security/advisories/GHSA-g9xm-7538-mq8wVendor Advisory
https://github.com/Exiv2/exiv2/pull/2337Patch
https://github.com/Exiv2/exiv2/security/advisories/GHSA-g9xm-7538-mq8wVendor Advisory

FAQ

What is CVE-2024-24826?

CVE-2024-24826 is a vulnerability with a CVSS score of 5.5 (MEDIUM). Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.1. The vulnerable func...

How severe is CVE-2024-24826?

CVE-2024-24826 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-24826?

Check the references section above for vendor advisories and patch information. Affected products include: Exiv2 Exiv2.