Exiv2 CVE-2026-68547

Exploitation requires the user or an automated process to explicitly invoke exiv2 with a URL argument pointing to an attacker-controlled remote resource - the RemoteIo class is not activated for local file processing. The attacker must control or influence the remote server serving the image file and must be able to get the target to run exiv2 with that URL. Exploitation is limited by this user-interaction requirement and by the non-default nature of URL-based invocation: standard Exiv2 use against local files is entirely unaffected. Authentication requirements are not confirmed from available data (no CVSS vector was provided in the input).

Real-world risk is low. The vulnerability is constrained by a strong prerequisite: the user must explicitly invoke exiv2 with a URL argument, which is an atypical usage pattern - the vast majority of Exiv2 deployments process local files only. The vendor rates this low severity, consistent with the limited attack surface. No EPSS score, KEV listing, or public exploit code is available, meaning exploitation probability signals are absent. The CVSS vector was not provided by NVD; independent assessment places this at a moderate network-reachable score due to required user interaction. While the advisory discloses the exact triggering command (functioning as a minimal PoC), no standalone exploit has been published. The primary concern is for automated pipelines or scripts that pass externally-controlled URLs to exiv2, where the user-interaction barrier may be lower.

An attacker operates a web server and serves a crafted JPEG or other image file designed to trigger the out-of-bounds read in populateBlocks(). A user or automated script runs exiv2 against the attacker-controlled URL (e.g., exiv2 https://attacker.example.com/evil.jpg), causing the vulnerable code path to execute, potentially leaking adjacent heap memory to the attacker via error output or crashing the process. The advisory's disclosure of the exact triggering command reduces the effort required to reproduce the issue.