CVE-2021-3482

2021-04-0822:06:42

CWE-20

redhat

www.cve.org

exiv2

heap-based buffer overflow

crafted jpg image

improper input validation

rawdata.size property

jp2image::readmetadata()

jp2image.cpp

malicious exif data

AI Score

Confidence

High

EPSS

0.006

Percentile

77.9%

JSON

A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data.

CNA Affected

[
  {
    "product": "exiv2",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "exiv2 0.27.4RC2"
      }
    ]
  }
]