CVE-2026-25884: 
NixOS vulnerability analysis and mitigation

CVE-2026-25884 is an out-of-bounds read vulnerability in the CRW image parser of Exiv2, a widely used C++ library and command-line utility for reading, writing, deleting, and modifying image metadata (Exif, IPTC, XMP, ICC). The flaw exists in the CrwMap::decode0x0805 function and affects all Exiv2 versions prior to 0.28.8. It was discovered via OSS-Fuzz, reported on March 1–2, 2026, and patched in version 0.28.8. The CVSS v3.1 base score is 8.1 (High), though the vendor's own GitHub advisory rates it as Low severity (GitHub Advisory, Feedly).

The root cause is an out-of-bounds read (CWE-125) in CrwMap::decode0x0805 within src/crwimage_int.cpp. The vulnerable code constructs a std::string from a raw pointer (ciffComponent.pData()) without specifying a length bound, causing it to read past the end of the buffer until a null byte is encountered: std::string s(reinterpret_cast<const char*>(ciffComponent.pData())). The fix replaces this with a length-bounded constructor: auto s = std::string(reinterpret_cast<const char*>(ciffComponent.pData()), ciffComponent.size()). Exploitation requires a victim to open or process a specially crafted CRW image file through an application using the vulnerable Exiv2 library; the bug was reproducible with the OSS-Fuzz target but not with the standard exiv2 command-line application (GitHub PR #3462, GitHub Commit).

Successful exploitation can result in unauthorized disclosure of memory contents (high confidentiality impact) and application crash or denial of service (high availability impact), with no integrity impact. The vulnerability affects any application or service that uses the Exiv2 library to process CRW image files, including image editors, media management tools, and metadata processing pipelines. Because Exiv2 is embedded in many downstream applications, the blast radius extends beyond the library itself to all dependent software (GitHub Advisory, Feedly).

No in-the-wild exploitation has been reported, and the EPSS score is approximately 0.04% (very low probability of exploitation in the near term). The vulnerability was discovered through automated fuzzing (OSS-Fuzz) and a proof-of-concept fuzz corpus file (issue_ghsa_9mxq_4j5g_5wrp.crw) is publicly available in the Exiv2 repository. The bug could not be reproduced using the standard exiv2 command-line tool, limiting practical exploitability. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (GitHub Advisory, Feedly).

1. Craft a malicious CRW file: Create or obtain a specially crafted Canon CRW image file where the CIFF component data for tag 0x0805 lacks a null terminator within the allocated buffer bounds, causing the string constructor to read beyond the buffer.
2. Deliver the file to a target: Distribute the malicious CRW file to a victim via email attachment, web upload, shared storage, or any channel where the file will be processed by an application using a vulnerable Exiv2 version (< 0.28.8).
3. Trigger processing: Induce the victim or an automated system to open or process the file with an Exiv2-dependent application (e.g., an image viewer, photo management tool, or metadata extractor).
4. Out-of-bounds read occurs: When CrwMap::decode0x0805 is called, the unbounded std::string constructor reads past the end of the CIFF component buffer, potentially exposing adjacent memory contents or causing a crash.
5. Achieve objective: Depending on memory layout, the attacker may obtain leaked memory contents (information disclosure) or cause a denial of service via application crash (GitHub Advisory, GitHub PR #3462).

• File System: Presence of unexpected or externally sourced .crw files in directories processed by Exiv2-dependent applications; test file issue_ghsa_9mxq_4j5g_5wrp.crw (74 bytes) matching the known PoC artifact.
• Logs: Application crash logs or core dumps originating from processes invoking CrwMap::decode0x0805; error output such as No Exif data found in the file with exit code 253 when processing suspicious CRW files.
• Process: Unexpected termination or segmentation faults in image processing applications (e.g., image viewers, metadata tools) when handling CRW files from untrusted sources.

The primary remediation is to upgrade Exiv2 to version 0.28.8 or later, which contains the fix merged via pull request #3462 (GitHub PR #3462, GitHub Commit). Ubuntu has issued security notices USN-8103-1 and USN-8103-2, Amazon Linux 2 has released ALAS2-2026-3201, and openSUSE has published a corresponding security update — users of these distributions should apply the available OS-level patches. As a temporary workaround where patching is not immediately possible, restrict or disable processing of CRW image files in affected applications, and implement input validation or file-type filtering before passing images to Exiv2.

The vulnerability was assigned Low severity by the Exiv2 maintainer (kevinbackhouse) in the GitHub Security Advisory, reflecting the limited practical exploitability — the bug was only reproducible via fuzzing, not through normal application use. Ubuntu, Amazon Linux 2, openSUSE, and Fedora have all issued distribution-level security advisories and patches, indicating broad ecosystem awareness. The SOS Intelligence CVE Chatter Weekly Top Ten for March 23, 2026 included this CVE, suggesting moderate community interest (GitHub Advisory).