crw-PoC

crw: security advisory CVE status: requested, pending assignment. This finding is published as GHSA-5jp3-339h-vxqw. On CVE assignment this repository is renamed CVE-YYYY-NNNNN-crw-PoC and this banner is replaced with the CVE link...

MGASA-2026-0379 Updated exiv2 package fixes security vulnerabilities

Heap out-of-bounds write in RemoteIo when reading from a malicious remote server WebReady/Curl builds. CVE-2026-68546 Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files. CVE-2026-68547 Out of bounds read in CrwMap::decodeBasic. CVE-2026-49275...

CVE-2026-68547

GHSA-jcgh-p9v3-pw6j: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files...

EUVD-2026-66462

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Implement a crw lock Unlike the channelprogram struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a...

CVE-2026-80547

A flaw was found in the Linux kernel's s390/vfioccw component. This vulnerability arises from the lack of a proper lock to manage the list of Channel Report Word CRW payloads, which are asynchronous events from hardware. Without this lock, these payloads may not be read cohesively, potentially...

CVE-2026-80547

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Implement a crw lock Unlike the channelprogram struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a...

AZL-97737 CVE-2026-80547 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Implement a crw lock Unlike the channelprogram struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a...

UBUNTU-CVE-2026-80547

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Implement a crw lock Unlike the channelprogram struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a...

CVE-2026-80547

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Implement a crw lock Unlike the channelprogram struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a...

CVE-2026-80547 s390/vfio_ccw: Implement a crw lock

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Implement a crw lock Unlike the channelprogram struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a...

CVE-2026-80547 s390/vfio_ccw: Implement a crw lock

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Implement a crw lock Unlike the channelprogram struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a...

PT-2026-82163

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390/vfio ccw component where the CRW region, which relies exclusively on asynchronous events from hardware, lacks a proper locking mechanism. This necessitates th...

Linux Distros Unpatched Vulnerability : CVE-2026-80547

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/vfioccw: Implement a crw lock Unlike the channelprogram struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies...

JLSEC-2026-1316

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found. The vulnerability is in the CRW image parser. This issue has been patched in version 0.28.8...

SUSE-SU-2026:2663-1 Security update for exiv2

This update for exiv2 fixes the following issues - CVE-2025-54080: out-of-bounds read in Exiv2::EpsImage::writeMetadata when writing metadata into a crafted image file bsc1248962. - CVE-2026-25884: out-of-bounds read in CrwMap::decode0x0805 bsc1259083. - CVE-2026-27596: integer overflow in...

MAL-2026-4746 Malicious code in crw (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4324181416ad15727c0f51a30b56858c42fad99b93635922494acfe4c0f5d597 Package 'crw' impersonates the Firecrawl SDK: it declares 'firecrawl' as a keyword, replicates Firecrawl's client surface...

openSUSE 16 Security Update : exiv2 (openSUSE-SU-2026:20410-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20410-1 advisory. Update to exiv2 0.28.8: - CVE-2024-24826: out-of-bounds read in QuickTimeVideo: NikonTagsDecoder bsc1219870. - CVE-2024-25112: denial of service...

CLSA-2026-1774266713 exiv2: Fix of 2 CVEs

CVE-2026-25884: fix out-of-bounds read in CRW image parser - CVE-2026-27596: fix integer underflow in preview component...

CLSA-2026-1774266009 exiv2: Fix of 2 CVEs

CVE-2026-25884: fix out-of-bounds read in CRW image parser - CVE-2026-27596: fix integer underflow in preview component...

OPENSUSE-SU-2026:20410-1 Security update for exiv2

This update for exiv2 fixes the following issues: Update to exiv2 0.28.8: - CVE-2024-24826: out-of-bounds read in QuickTimeVideo: NikonTagsDecoder bsc1219870. - CVE-2024-25112: denial of service due to unbounded recursion in QuickTimeVideo: multipleEntriesDecoder bsc1219871. - CVE-2024-39695:...