Debian Linux - exiv2 - None

Ubuntu Linux - [GHSA-3695-mjv8-3r52: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (WebReady/Curl builds)]

The version of exiv2 installed on the remote host is prior to 0.27.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3946 advisory.

    Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (WebReady/Curl builds)     (CVE-2026-68546)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23871-1 advisory.

    - CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic (bsc#1277791).
    - CVE-2026-68546: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files     (bsc#1277579).
    - CVE-2026-68547: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server     (bsc#1277591).

    Changes for exiv2:

    - update to 0.28.9:
     * https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52
     * https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j
     * https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649
     * https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q
     * https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2
     * https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp
     * https://github.com/Exiv2/exiv2/security/advisories/GHSA-pwvq-9w4q-786w

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21904-1 advisory.

    - CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic (bsc#1277791).
    - CVE-2026-68546: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files     (bsc#1277579).
    - CVE-2026-68547: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server     (bsc#1277591).

    Changes for exiv2:

    - update to 0.28.9:
     * https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52
     * https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j
     * https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649
     * https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q
     * https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2
     * https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp
     * https://github.com/Exiv2/exiv2/security/advisories/GHSA-pwvq-9w4q-786w

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The vulnerability exists due to an out-of-bounds write flaw in the RemoteIo::Impl::populateBlocks()     function. When Exiv2 processes network-hosted metadata via a remote URL instead of a local file, it fails     to safely validate memory bounds during block structure allocation, enabling potential memory corruption     or execution disruption.  (CVE-2026-68546)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Exiv2 installed on the remote host is prior to 0.28.9. It is, therefore, affected by multiple vulnerabilities:

  - An out-of-bounds write was found in RemoteIo::Impl::populateBlocks. The bug is in the RemoteIo class, which     is only used when Exiv2 is run on a URL, rather than a local file. (CVE-2026-68546)

  - An out-of-bounds read was found in RemoteIo::Impl::populateBlocks. The bug is in the RemoteIo class, which     is only used when Exiv2 is run on a URL, rather than a local file. (CVE-2026-68547)

  - An out-of-bounds read was found in CrwMap::decodeBasic(). The bug was found by OSS-Fuzz. It is reproducible     with the project's fuzz target, but the maintainers have not been able to reproduce it with the exiv2     command line application. (CVE-2026-49275)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
351064	Amazon Linux 2 : exiv2 (ALAS-2026-3946)	Nessus	Amazon Linux Local Security Checks	Local	high
350830	SUSE SLES16 Security Update : exiv2 (SUSE-SU-2026:23871-1)	Nessus	SuSE Local Security Checks	Local	high
350166	openSUSE 16: exiv2 / exiv2-lang / libexiv2-28 / libexiv2-28-x86-64-v3 / etc (openSUSE-SU-2026:21904-1)	Nessus	SuSE Local Security Checks	Local	high
343101	Linux Distros Unpatched Vulnerability : CVE-2026-68546	Nessus	Misc.	Local	critical
342600	Exiv2 < 0.28.9 Multiple Vulnerabilities	Nessus	Misc.	Local	info

Detections

Analytics

CVE-2026-68546

high

Tenable Plugins

high

high

high

critical

info