CVE-2026-27631: 
NixOS vulnerability analysis and mitigation

CVE-2026-27631 is an uncaught exception vulnerability in Exiv2, a C++ library and command-line utility for reading, writing, deleting, and modifying Exif, IPTC, XMP, and ICC image metadata. The vulnerability affects Exiv2 versions prior to 0.28.8 and resides in the preview component, specifically triggered when processing PSD files with the -pp command-line argument. It was discovered via the project's fuzz-preview fuzzing target and disclosed on March 1–2, 2026. The CVSS v3.1 base score is 5.3 (Medium), while the CVSS v4.0 base score is 2.7 (Low) (GitHub Advisory, Feedly).

The root cause is an integer overflow (CWE-190) in the PsdImage::readResourceBlock function within src/psdimage.cpp, which is classified under CWE-248 (Uncaught Exception) as the overflow leads to an unhandled exception. When parsing PSD resource blocks, the nativePreview.size_ field is read from attacker-controlled file data without bounds validation; the overflowed value is then used to allocate a std::vector, causing the allocation to exceed max_size() and throwing an uncaught C++ exception that crashes the process. The fix (PR #3514, commit 659db31) adds an Internal::enforce check asserting that nativePreview.size_ does not exceed std::numeric_limits<size_t>::max() before the cast, returning kerCorruptedMetadata on violation (GitHub PR, GitHub Commit). Exploitation requires supplying a specially crafted PSD file and invoking Exiv2 with the -pp (preview print) argument (GitHub Advisory).

Successful exploitation causes Exiv2 to crash with an uncaught exception, resulting in a denial of service. The impact is limited to availability of the Exiv2 process; there is no confidentiality breach or unauthorized data modification. Automated image processing pipelines or metadata extraction workflows that invoke Exiv2 with preview arguments on untrusted input files are most at risk of disruption (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.042%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to supply a crafted PSD file to a system that processes it with Exiv2 using the -pp flag, limiting the attack surface to specific workflows (Feedly, GitHub Advisory).

1. Craft a malicious PSD file: Create a PSD image file with a resource block where the nativePreview.size_ field is set to a value that, after integer overflow, results in an excessively large allocation request exceeding std::vector::max_size().
2. Deliver the file to the target: Place the crafted PSD file in a location accessible to the Exiv2 process — for example, an upload endpoint, shared directory, or automated processing queue that feeds files to Exiv2.
3. Trigger preview processing: Ensure Exiv2 is invoked with the -pp (print preview) argument against the malicious file, e.g., exiv2 -pp malicious.psd.
4. Observe crash: The integer overflow in PsdImage::readResourceBlock causes an attempt to allocate an oversized std::vector, throwing an uncaught C++ exception and crashing the Exiv2 process, disrupting any dependent workflow (GitHub Advisory, GitHub PR).

• File System: Presence of unexpected or anomalous PSD files in directories monitored by automated Exiv2 processing pipelines; specifically files with malformed resource block size fields.
• Logs: Exiv2 process termination logs showing uncaught C++ exceptions (e.g., std::length_error: cannot create std::vector larger than max_size()) or abnormal exit codes (exit code 1) when processing PSD files with -pp.
• Process: Unexpected crashes or restarts of Exiv2-based services or batch processing jobs, particularly when handling externally supplied PSD image files.

Upgrade Exiv2 to version 0.28.8 or later, which includes the fix introduced in commit 659db31 via PR #3514 (GitHub Commit). Ubuntu users can apply the patch via security notices USN-8103-1 and USN-8103-2; Amazon Linux 2 users should apply ALAS2-2026-3201; openSUSE users should apply the update announced on the security-announce mailing list. As an interim workaround for organizations unable to upgrade immediately, restrict or disable the use of the -pp (preview print) argument when processing untrusted image files, and implement input validation to reject malformed PSD files before they reach Exiv2 (GitHub Advisory).

The vulnerability was discovered internally by the Exiv2 project maintainer Kevin Backhouse using the newly added fuzz-preview OSS-Fuzz target, and was patched promptly before public disclosure. The advisory was rated Low severity by the Exiv2 project. Downstream Linux distributions including Ubuntu, Amazon Linux 2, openSUSE, and Fedora issued security updates shortly after the disclosure. No significant independent researcher commentary or notable media coverage has been identified beyond standard vulnerability tracking and distribution advisories (GitHub Advisory).