Detections
Analytics
Exiv2 < 0.28.9 Multiple Vulnerabilities
info Nessus Plugin ID 342600
Synopsis
The remote host is missing a security update.Description
The version of Exiv2 installed on the remote host is prior to 0.28.9. It is, therefore, affected by multiple vulnerabilities:- An out-of-bounds write was found in RemoteIo::Impl::populateBlocks. The bug is in the RemoteIo class, which is only used when Exiv2 is run on a URL, rather than a local file. (CVE-2026-68546)
- An out-of-bounds read was found in RemoteIo::Impl::populateBlocks. The bug is in the RemoteIo class, which is only used when Exiv2 is run on a URL, rather than a local file. (CVE-2026-68547)
- An out-of-bounds read was found in CrwMap::decodeBasic(). The bug was found by OSS-Fuzz. It is reproducible with the project's fuzz target, but the maintainers have not been able to reproduce it with the exiv2 command line application. (CVE-2026-49275)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Exiv2 version 0.28.9 or later.See Also
https://github.com/Exiv2/exiv2/releases/tag/v0.28.9
https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52
https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649
https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j
Plugin Details
Severity: Info
ID: 342600
File Name: exiv2_0_28_9.nasl
Version: 1.1
Type: Local
Agent: unix
Family: Misc.
Published: 9/3/2026
Updated: 9/3/2026
Configuration: Enable thorough checks (optional)
Supported Sensors: Nessus Agent, Nessus
Risk Information
Vulnerability Information
CPE: cpe:/a:exiv2:exiv2
Required KB Items: installed_sw/Exiv2
Patch Publication Date: 8/30/2026
Vulnerability Publication Date: 8/30/2026