An out-of-bounds write in http.cpp.

Exiv2’s optional built-in HTTP transport writes outside its bounds when handed a sufficiently long URL. The maintainers published the advisory with a minimal description and a reproduction command, and this page stays at that level deliberately.

AdvisoryGHSA-9v3x-mhg4-wwv2

ProjectExiv2

EcosystemC / C++

Affected≤ 0.28.8

Fixed0.28.9

WeaknessCWE-125 / CWE-787

SeverityLow

Reporterthe-vibe-dev

Where a maintainer has chosen to publish a short advisory, a write-up should not become the detailed disclosure the maintainer declined to make.

Weakness

CWE-125 / CWE-787

Surface

Exiv2::http

Build

optional WebReady transport

Outcome

out-of-bounds write

Publication boundary.This page reproduces what the maintainers published and nothing further. The advisory is deliberately brief; the private report contained more detail, and that detail is not republished here. No reusable payload, offset, or memory layout appears on this page.

Exiv2 can be built with an optional HTTP transport used to read image metadata directly from a URL. The advisory records an out-of-bounds write in that transport, in http.cpp.

The published text is short. In full, the technical claim is:

An out-of-bounds write was found in Exiv2::http.

Affected versions are 0.28.8 and earlier; the fix is in 0.28.9. The advisory assigns Low severity and records both CWE-125 (out-of-bounds read) and CWE-787 (out-of-bounds write). No CVE identifier is shown on the advisory.

The advisory carries a reproduction command, which is public and reproduced verbatim:

Published reproductionfrom the advisory

exiv2 -pa `python -c "print('http://127.0.0.1:8769/' + 'A' * 100000)"`

The command is self-directed: the operator supplies the oversized URL on their own command line, against a loopback address. That shape is what holds the severity at Low. A long argument the user types themselves is not an attack.

The advisory notes that the same code path is reachable when Exiv2 is pointed at a remote resource, in the ordinary form:

Remote-delivery shapefrom the advisory

exiv2 -Mset Exif.Image.Artist PwnMe https://dodgywebsite.com/poc.jpg

The distinction that matters for severity is who controls the length. In the first case it is the operator; in the second, part of the input comes from the far end. The advisory stops short of establishing a full remote primitive, and so does this page.

01 · Build

Optional transport

Only builds with the WebReady HTTP transport enabled are affected.

02 · Input

Oversized URL

A URL long enough to exceed the transport’s assumptions.

03 · Write

Out-of-bounds

The request-construction path writes outside its buffer.

04 · Effect

Memory corruption

Published as an out-of-bounds write at Low severity.

A reader comparing this page to the other write-ups on this site will notice it is much shorter, and that is the point. The private report to the maintainers contained a root-cause analysis, sanitizer output, and a proposed guard. The maintainers published a one-line advisory instead.

The reporter does not get to overrule that decision by publishing the analysis on their own site. The advisory is the disclosure; the write-up follows it.

If the project later publishes fuller detail or a fixing commit reference, this page can be expanded to match. Until then it stays at advisory level.

Upgrade to Exiv2 0.28.9 or later.

Builds without the optional HTTP transport are not affected. Where the transport is not required, omitting it removes the surface entirely — generally the right default for a metadata library embedded in a larger application, since it also removes an outbound network capability that most callers do not want.

Credit: Reported by the-vibe-dev. Research was SecHive-assisted through source mapping, hypothesis generation and evidence organization; final validation, disclosure coordination and publication review remained human. This page is limited to material the maintainers published.