Out-of-bounds write in exiv2

CVE-2023-44398

What is CVE-2023-44398?

Exiv2, a C++ library used for handling image metadata, contains a vulnerability that allows for out-of-bounds writes in version v0.28.0. This issue is triggered when the library reads the metadata from specially crafted image files. If exploited, it could let an attacker execute arbitrary code by tricking a victim into processing such a file with Exiv2. The vulnerability has been patched in version v0.28.1, and users are encouraged to update immediately, as there are no known workarounds available.

References