CVE-2026-27596: 
NixOS vulnerability analysis and mitigation

CVE-2026-27596 is an integer underflow (wrap or wraparound) leading to an out-of-bounds read in Exiv2's LoaderNative::getData() function within the preview component. It affects all Exiv2 versions prior to 0.28.8 and was reported by researcher @zerojackyi, disclosed on March 2, 2026, and patched in version 0.28.8. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 2.7 (Low), reflecting that exploitation requires specific command-line invocation and results only in a denial of service (GitHub Advisory, Feedly).

The root cause is an integer underflow (CWE-191) in LoaderNative::getData() within src/preview.cpp, where the code computes sizeData - 28 without first verifying that sizeData is at least 28. When processing a malformed EPS file with a specially crafted Photoshop preview block, the subtraction wraps around to a very large value, causing a subsequent out-of-bounds read at approximately a 4 GB memory offset (CWE-125). The vulnerability is only triggered when Exiv2 is invoked with the -pp (print preview) command-line argument. The fix adds an Internal::enforce(sizeData >= 28, ErrorCode::kerCorruptedMetadata) check before the arithmetic operation (GitHub Advisory, GitHub Commit, GitHub PR).

Successful exploitation causes Exiv2 to crash due to the out-of-bounds memory read at a ~4 GB offset, resulting in a denial of service condition. There is no impact on confidentiality or data integrity — the vulnerability cannot be used to read sensitive data or modify files. The impact is limited to availability of the Exiv2 process itself, and lateral movement or privilege escalation are not applicable given the nature of the flaw (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.042%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires that an attacker be able to supply a crafted EPS image file to a user or system running Exiv2 with the -pp argument, limiting the practical attack surface (GitHub Advisory, Feedly).

1. Craft a malicious EPS file: Create a specially crafted EPS file containing a %BeginPhotoshop block with a Photoshop preview section where the declared data size is less than 28 bytes (e.g., as demonstrated in the proof-of-concept issue_3511_poc.eps included in the Exiv2 test suite).
2. Deliver the file to the target: Provide the malicious EPS file to a user or automated pipeline that processes image metadata using a vulnerable version of Exiv2 (prior to 0.28.8).
3. Trigger the preview component: Ensure Exiv2 is invoked with the -pp (print preview) argument against the crafted file, e.g., exiv2 -pp malicious.eps.
4. Trigger the integer underflow: The LoaderNative::getData() function computes sizeData - 28 without bounds checking; with sizeData < 28, the result wraps around to a very large unsigned value.
5. Cause out-of-bounds read and crash: Exiv2 attempts to read memory at approximately a 4 GB offset, causing a segmentation fault and application crash (denial of service) (GitHub Advisory, GitHub Commit).

• Process: Exiv2 process terminating unexpectedly with a segmentation fault (SIGSEGV) or similar crash signal when processing EPS files with the -pp argument.
• Logs: System crash logs or core dumps referencing LoaderNative::getData() in the Exiv2 binary; error messages such as kerCorruptedMetadata in Exiv2 stderr output (post-patch behavior).
• File System: Presence of unexpected or externally supplied EPS files containing %BeginPhotoshop blocks with anomalously small data size declarations (e.g., fewer than 28 bytes in the preview section).
• Network: Unusual inbound delivery of EPS files to systems running automated Exiv2-based metadata processing pipelines (GitHub Advisory).

Upgrade Exiv2 to version 0.28.8 or later, which includes the fix adding an integer overflow enforcement check in src/preview.cpp (GitHub Advisory, GitHub Commit). Ubuntu users can apply the fix via security notices USN-8103-1 and USN-8103-2, Amazon Linux 2 users via ALAS2-2026-3201, and openSUSE users via the security-announce mailing list advisory. If immediate patching is not possible, restrict use of the -pp command-line argument, limit Exiv2 access to trusted input sources, and disable preview functionality in automated pipelines where it is not required (Feedly).

The vulnerability was assigned Low severity by the Exiv2 maintainers and GitHub, reflecting its limited exploitability and denial-of-service-only impact. Multiple Linux distributions including Ubuntu, Amazon Linux 2, openSUSE, and Fedora issued security advisories and package updates following the disclosure. Coverage was limited to routine vulnerability tracking outlets and Linux security news sites, with no notable researcher commentary or significant social media discussion beyond automated CVE feeds (Ubuntu USN-8103-1, Amazon Linux ALAS).