CVE-2024-39695: exiv2 Out-of-bounds Read
Vulnerability summary
CVE-2024-39695 is a medium (CVSS 6.5) Out-of-bounds Read vulnerability in exiv2. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 08-07-2024PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.2. The vulnerability is in the parser for the ASF video format, which was a new feature in v0.28.0. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted video file. The bug is fixed in version v0.28.3.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
EPSS trend
Probability
0.56%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
0.00 pp
From 0.56% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Exiv21 product
- exiv2≥ 0.28.0, < 0.28.3
Opensuse1 product
- exiv2&distro=openSUSE Tumbleweed< 0.28.3-1.1
2 vendors · 2 products
