CVE-2020-18771

Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn_int.cpp which can result in an information leak.

Red Hat Product Security has determined the Impact to this bug as low for the following reasons:

• The attacker needs access to the system to trigger the bug as exiv2 is a library accompanied by a command line utility.
• While it is possible to crash exiv2 with a malicious payload, there is no known exploit to be able to run arbitrary code or escalate privileges. This only creates an availability problem.
• The bug does not affect any other resources in terms of integrity, confidentiality or avialability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.