CVE-2021-31292
exiv2: Integer overflow in CrwMap:encode0x1810 leading to heap-based buffer overflow and DoS
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · July 26, 2021
Updated · June 27, 2026
Description
A flaw was found in exiv2. A integer wraparound in the CrwMap:encode0x1810 function leads to memcpy call with a very large size allowing an attacker, who can provide a malicious image, to crash an application which uses the exiv2 library. The highest threat from this vulnerability is to service availability.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-190 · Integer Overflow or Wraparound