CVE-2018-9305 — exiv2: out of bounds read in IptcData::printStructure in iptc.c

Back Back to CVE browser

HIGH

exiv2: out of bounds read in IptcData::printStructure in iptc.c

Published Apr 4, 2018

8.1

HIGH

CVSS 3.0

EPSS 1.92%

Description

In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak, related to the "== 0x1c" case.

Affected products

Red Hat Enterprise Linux 7

exiv2-0:0.27.0-2.el7_6

Fixed · RHSA-2019:2101
Red Hat Enterprise Linux 8

exiv2-0:0.27.2-5.el8

Fixed · RHSA-2020:1577
Red Hat Enterprise Linux 8

gegl-0:0.2.0-39.el8

Fixed · RHSA-2020:1577
Red Hat Enterprise Linux 8

gnome-color-manager-0:3.28.0-3.el8

Fixed · RHSA-2020:1577
Red Hat Enterprise Linux 8

libgexiv2-0:0.10.8-4.el8

Fixed · RHSA-2020:1577
Red Hat Enterprise Linux 6

exiv2

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	exiv2-0:0.27.0-2.el7_6	Fixed	RHSA-2019:2101
Red Hat Enterprise Linux 8	exiv2-0:0.27.2-5.el8	Fixed	RHSA-2020:1577
Red Hat Enterprise Linux 8	gegl-0:0.2.0-39.el8	Fixed	RHSA-2020:1577
Red Hat Enterprise Linux 8	gnome-color-manager-0:3.28.0-3.el8	Fixed	RHSA-2020:1577
Red Hat Enterprise Linux 8	libgexiv2-0:0.10.8-4.el8	Fixed	RHSA-2020:1577
Red Hat Enterprise Linux 6	exiv2	Not affected	n/a

Remediation

Red Hat statement

This issue did not affect the versions of Exiv2 as shipped with Red Hat Enterprise Linux 6 and 7, up to 7.4, as they did not include support for printing IPTC Photo Metadata.

Metrics

1.92% 0.01924

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.01924

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	1.92% (0.01924)	79.23th	v5 (v2026.06.15)
Sep 20, 2026	1.92% (0.01924)	79.03th	v5 (v2026.06.15)
Jul 20, 2024	0.34% (0.00336)	71.58th	v3 (v2023.03.01)
Feb 8, 2024	0.34% (0.00336)	70.50th	v3 (v2023.03.01)
Sep 3, 2023	0.34% (0.00336)	67.64th	v3 (v2023.03.01)
Mar 7, 2023	0.42% (0.00416)	70.04th	v3 (v2023.03.01)
Mar 6, 2023	1.02% (0.01018)	40.69th	v2 (v2022.01.01)
Feb 4, 2022	1.02% (0.01018)	19.50th	v2 (v2022.01.01)
Feb 3, 2022	1.25% (0.01247)	30.57th	v5 (v2026.06.15)
Apr 14, 2021	1.25% (0.01247)	0.00th	v1

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (9)

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html
vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2101
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2018-9305
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1566735
Issue Tracking
https://github.com/Exiv2/exiv2/issues/263
x_refsource_MISCExploitIssue TrackingPatch
https://github.com/xiaoqx/pocs/blob/master/exiv2/readme.md
x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-9305
https://security.gentoo.org/glsa/201811-14
vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-9305

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html		vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2019:2101		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2018-9305		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1566735		Issue Tracking
https://github.com/Exiv2/exiv2/issues/263		x_refsource_MISCExploitIssue TrackingPatch
https://github.com/xiaoqx/pocs/blob/master/exiv2/readme.md		x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-9305
https://security.gentoo.org/glsa/201811-14		vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-9305