CVE-2021-37618

Exiv2 is a command-line utility and C++ library for reading, writing,
deleting, and modifying the metadata of image files. An out-of-bounds read
was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is
triggered when Exiv2 is used to print the metadata of a crafted image file.
An attacker could potentially exploit the vulnerability to cause a denial
of service, if they can trick the victim into running Exiv2 on a crafted
image file. Note that this bug is only triggered when printing the image
ICC profile, which is a less frequently used Exiv2 operation that requires
an extra command line option (-p C). The bug is fixed in version v0.27.5.

Notes