An update for exiv2 is now available for openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3888 Final 1.0 1.0 2026-09-20 Initial 2026-09-20 2026-09-20 openEuler SA Tool V1.0 2026-09-20 exiv2 security update An update for exiv2 is now available for openEuler-20.03-LTS-SP4 Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats. Security Fix(es): Exiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275) Exiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546) Exiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.(CVE-2026-68547) An update for exiv2 is now available for openEuler-20.03-LTS-SP4. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical exiv2 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3888 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-49275 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-68546 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-68547 https://nvd.nist.gov/vuln/detail/CVE-2026-49275 https://nvd.nist.gov/vuln/detail/CVE-2026-68546 https://nvd.nist.gov/vuln/detail/CVE-2026-68547 openEuler-20.03-LTS-SP4 exiv2-0.27.5-8.oe2003sp4.aarch64.rpm exiv2-debuginfo-0.27.5-8.oe2003sp4.aarch64.rpm exiv2-debugsource-0.27.5-8.oe2003sp4.aarch64.rpm exiv2-devel-0.27.5-8.oe2003sp4.aarch64.rpm exiv2-0.27.5-8.oe2003sp4.src.rpm exiv2-0.27.5-8.oe2003sp4.x86_64.rpm exiv2-debuginfo-0.27.5-8.oe2003sp4.x86_64.rpm exiv2-debugsource-0.27.5-8.oe2003sp4.x86_64.rpm exiv2-devel-0.27.5-8.oe2003sp4.x86_64.rpm exiv2-help-0.27.5-8.oe2003sp4.noarch.rpm Exiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405). 2026-09-20 CVE-2026-49275 openEuler-20.03-LTS-SP4 High 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H exiv2 security update 2026-09-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3888 Exiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4. 2026-09-20 CVE-2026-68546 openEuler-20.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H exiv2 security update 2026-09-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3888 Exiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa. 2026-09-20 CVE-2026-68547 openEuler-20.03-LTS-SP4 High 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H exiv2 security update 2026-09-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3888