Nixpkgs security tracker

Untriaged

Permalink CVE-2026-25884

created 1 month, 3 weeks ago Activity log

Created suggestion 1 month, 3 weeks ago

Exiv2: Out-of-bounds read in CrwMap::decode0x0805

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found. The vulnerability is in the CRW image parser. This issue has been patched in version 0.28.8.

References

https://github.com/Exiv2/exiv2/security/advisories/GHSA-9mxq-4j5g-5wrp x_refsource_CONFIRM
https://github.com/Exiv2/exiv2/pull/3462 x_refsource_MISC
https://github.com/Exiv2/exiv2/commit/cbba4d206512fe63e12d164fdd1881562f072a9d x_refsource_MISC

Affected products

exiv2

==< 0.28.8

Matching in nixpkgs

pkgs.exiv2

Library and command-line utility to manage image metadata

nixos-unstable 0.28.7
- nixpkgs-unstable 0.28.7
- nixos-unstable-small 0.28.7
nixos-25.11 0.28.7
- nixos-25.11-small 0.28.7
- nixpkgs-25.11-darwin 0.28.7

pkgs.gexiv2

GObject wrapper around the Exiv2 photo metadata library

nixos-unstable 0.14.6
- nixpkgs-unstable 0.14.6
- nixos-unstable-small 0.14.6
nixos-25.11 0.14.6
- nixos-25.11-small 0.14.6
- nixpkgs-25.11-darwin 0.14.6

pkgs.libsForQt5.libkexiv2

None

pkgs.kdePackages.libkexiv2

Wrapper around Exiv2 library to manipulate picture metadata as EXIF and XMP

nixos-unstable 25.12.2
- nixpkgs-unstable 25.12.2
- nixos-unstable-small 25.12.2
nixos-25.11 25.08.3
- nixos-25.11-small 25.08.3
- nixpkgs-25.11-darwin 25.08.3

pkgs.python312Packages.exiv2

Low level Python interface to the Exiv2 C++ library

nixos-25.11 exiv2-0.17.5
- nixos-25.11-small exiv2-0.17.5
- nixpkgs-25.11-darwin exiv2-0.17.5

pkgs.python313Packages.exiv2

Low level Python interface to the Exiv2 C++ library

nixos-unstable exiv2-0.18.0
- nixpkgs-unstable exiv2-0.18.0
- nixos-unstable-small exiv2-0.18.0
nixos-25.11 exiv2-0.17.5
- nixos-25.11-small exiv2-0.17.5
- nixpkgs-25.11-darwin exiv2-0.17.5