CVE-2024-24826 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2024-24826 Interim 1 12 2026-03-05T02:50:02Z current 2024-02-14T00:09:08Z 2026-03-05T02:50:02Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2024-24826 Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.1. The vulnerable function, `QuickTimeVideo::NikonTagsDecoder`, was new in v0.28.0, so Exiv2 versions before v0.28 are _not_ affected. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted video file. In most cases this out of bounds read will result in a crash. This bug is fixed in version v0.28.2. Users are advised to upgrade. There are no known workarounds for this vulnerability. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE CaaS Platform 4.0 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP5 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise Module for Desktop Applications 15 SP5 SUSE Linux Enterprise Real Time 15 SP4 SUSE Linux Enterprise Server 11 SP4 LTSS SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Module for Desktop Applications 15 SP5 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server Teradata 12 SP3 SUSE Linux Enterprise Server Teradata 12 SP3-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Module for Desktop Applications 15 SP5 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9 openSUSE Tumbleweed exiv2 exiv2-0.28.2-1.1 exiv2-0_26 exiv2-lang-0.28.2-1.1 libexiv2-12 libexiv2-26 libexiv2-27 libexiv2-28-0.28.2-1.1 libexiv2-28-0.28.3-160000.2.2 libexiv2-28-x86-64-v3-0.28.2-1.1 libexiv2-28-x86-64-v3-0.28.3-160000.2.2 libexiv2-devel libexiv2-devel-0.28.2-1.1 libexiv2-xmp-static libexiv2-28-0.28.3-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 libexiv2-28-x86-64-v3-0.28.3-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 exiv2-0.28.2-1.1 as a component of openSUSE Tumbleweed exiv2-lang-0.28.2-1.1 as a component of openSUSE Tumbleweed libexiv2-28-0.28.2-1.1 as a component of openSUSE Tumbleweed libexiv2-28-x86-64-v3-0.28.2-1.1 as a component of openSUSE Tumbleweed libexiv2-devel-0.28.2-1.1 as a component of openSUSE Tumbleweed libexiv2-26 as a component of SUSE CaaS Platform 4.0 libexiv2-devel as a component of SUSE CaaS Platform 4.0 exiv2 as a component of SUSE CaaS Platform 4.0 libexiv2-26 as a component of SUSE Enterprise Storage 7.1 libexiv2-devel as a component of SUSE Enterprise Storage 7.1 exiv2 as a component of SUSE Enterprise Storage 7.1 exiv2 as a component of SUSE Linux Enterprise High Performance Computing 12 SP5 libexiv2-26 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libexiv2-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS exiv2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libexiv2-26 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS libexiv2-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS exiv2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS libexiv2-26 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS libexiv2-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS exiv2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS libexiv2-27 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS libexiv2-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS libexiv2-xmp-static as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS exiv2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS libexiv2-26 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS exiv2-0_26 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS libexiv2-27 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS libexiv2-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS libexiv2-xmp-static as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS exiv2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS libexiv2-26 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS exiv2-0_26 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS libexiv2-27 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP5 libexiv2-devel as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP5 libexiv2-xmp-static as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP5 exiv2 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP5 libexiv2-27 as a component of SUSE Linux Enterprise Real Time 15 SP4 libexiv2-devel as a component of SUSE Linux Enterprise Real Time 15 SP4 libexiv2-xmp-static as a component of SUSE Linux Enterprise Real Time 15 SP4 exiv2 as a component of SUSE Linux Enterprise Real Time 15 SP4 libexiv2-26 as a component of SUSE Linux Enterprise Real Time 15 SP4 exiv2-0_26 as a component of SUSE Linux Enterprise Real Time 15 SP4 exiv2 as a component of SUSE Linux Enterprise Server 11 SP4 LTSS libexiv2-12 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS exiv2 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS libexiv2-12 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS exiv2 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libexiv2-12 as a component of SUSE Linux Enterprise Server 12 SP5 exiv2 as a component of SUSE Linux Enterprise Server 12 SP5 libexiv2-26 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libexiv2-devel as a component of SUSE Linux Enterprise Server 15 SP1-LTSS exiv2 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libexiv2-26 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS libexiv2-devel as a component of SUSE Linux Enterprise Server 15 SP2-LTSS exiv2 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS libexiv2-26 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS libexiv2-devel as a component of SUSE Linux Enterprise Server 15 SP3-LTSS exiv2 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS libexiv2-27 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS libexiv2-devel as a component of SUSE Linux Enterprise Server 15 SP4-LTSS libexiv2-xmp-static as a component of SUSE Linux Enterprise Server 15 SP4-LTSS exiv2 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS libexiv2-26 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS exiv2-0_26 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS libexiv2-26 as a component of SUSE Linux Enterprise Server 15-LTSS libexiv2-devel as a component of SUSE Linux Enterprise Server 15-LTSS exiv2 as a component of SUSE Linux Enterprise Server 15-LTSS exiv2 as a component of SUSE Linux Enterprise Server Teradata 12 SP3 exiv2 as a component of SUSE Linux Enterprise Server Teradata 12 SP3-LTSS libexiv2-12 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 exiv2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libexiv2-12 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 exiv2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 exiv2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libexiv2-26 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libexiv2-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 exiv2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libexiv2-26 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 libexiv2-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 exiv2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 libexiv2-26 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 libexiv2-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 exiv2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 libexiv2-27 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 libexiv2-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 libexiv2-xmp-static as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 exiv2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 libexiv2-26 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 exiv2-0_26 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 libexiv2-devel as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 exiv2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libexiv2-12 as a component of SUSE OpenStack Cloud 9 exiv2 as a component of SUSE OpenStack Cloud 9 libexiv2-12 as a component of SUSE OpenStack Cloud Crowbar 9 exiv2 as a component of SUSE OpenStack Cloud Crowbar 9 Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.1. The vulnerable function, `QuickTimeVideo::NikonTagsDecoder`, was new in v0.28.0, so Exiv2 versions before v0.28 are _not_ affected. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted video file. In most cases this out of bounds read will result in a crash. This bug is fixed in version v0.28.2. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2024-24826 SUSE Linux Enterprise Server 16.0:libexiv2-28-0.28.3-160000.2.2 SUSE Linux Enterprise Server 16.0:libexiv2-28-x86-64-v3-0.28.3-160000.2.2 openSUSE Tumbleweed:exiv2-0.28.2-1.1 openSUSE Tumbleweed:exiv2-lang-0.28.2-1.1 openSUSE Tumbleweed:libexiv2-28-0.28.2-1.1 openSUSE Tumbleweed:libexiv2-28-x86-64-v3-0.28.2-1.1 openSUSE Tumbleweed:libexiv2-devel-0.28.2-1.1 SUSE CaaS Platform 4.0:exiv2 SUSE CaaS Platform 4.0:libexiv2-26 SUSE CaaS Platform 4.0:libexiv2-devel SUSE Enterprise Storage 7.1:exiv2 SUSE Enterprise Storage 7.1:libexiv2-26 SUSE Enterprise Storage 7.1:libexiv2-devel SUSE Linux Enterprise High Performance Computing 12 SP5:exiv2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:exiv2 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libexiv2-26 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libexiv2-devel SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:exiv2 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libexiv2-26 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libexiv2-devel SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:exiv2 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libexiv2-26 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:libexiv2-devel SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:exiv2 SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:exiv2-0_26 SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libexiv2-26 SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libexiv2-27 SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libexiv2-devel SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libexiv2-xmp-static SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:exiv2 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:exiv2-0_26 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libexiv2-26 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libexiv2-27 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libexiv2-devel SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libexiv2-xmp-static SUSE Linux Enterprise Module for Desktop Applications 15 SP5:exiv2 SUSE Linux Enterprise Module for Desktop Applications 15 SP5:libexiv2-27 SUSE Linux Enterprise Module for Desktop Applications 15 SP5:libexiv2-devel SUSE Linux Enterprise Module for Desktop Applications 15 SP5:libexiv2-xmp-static SUSE Linux Enterprise Real Time 15 SP4:exiv2 SUSE Linux Enterprise Real Time 15 SP4:exiv2-0_26 SUSE Linux Enterprise Real Time 15 SP4:libexiv2-26 SUSE Linux Enterprise Real Time 15 SP4:libexiv2-27 SUSE Linux Enterprise Real Time 15 SP4:libexiv2-devel SUSE Linux Enterprise Real Time 15 SP4:libexiv2-xmp-static SUSE Linux Enterprise Server 11 SP4 LTSS:exiv2 SUSE Linux Enterprise Server 12 SP2-LTSS:exiv2 SUSE Linux Enterprise Server 12 SP2-LTSS:libexiv2-12 SUSE Linux Enterprise Server 12 SP4-LTSS:exiv2 SUSE Linux Enterprise Server 12 SP4-LTSS:libexiv2-12 SUSE Linux Enterprise Server 12 SP5:exiv2 SUSE Linux Enterprise Server 12 SP5:libexiv2-12 SUSE Linux Enterprise Server 15 SP1-LTSS:exiv2 SUSE Linux Enterprise Server 15 SP1-LTSS:libexiv2-26 SUSE Linux Enterprise Server 15 SP1-LTSS:libexiv2-devel SUSE Linux Enterprise Server 15 SP2-LTSS:exiv2 SUSE Linux Enterprise Server 15 SP2-LTSS:libexiv2-26 SUSE Linux Enterprise Server 15 SP2-LTSS:libexiv2-devel SUSE Linux Enterprise Server 15 SP3-LTSS:exiv2 SUSE Linux Enterprise Server 15 SP3-LTSS:libexiv2-26 SUSE Linux Enterprise Server 15 SP3-LTSS:libexiv2-devel SUSE Linux Enterprise Server 15 SP4-LTSS:exiv2 SUSE Linux Enterprise Server 15 SP4-LTSS:exiv2-0_26 SUSE Linux Enterprise Server 15 SP4-LTSS:libexiv2-26 SUSE Linux Enterprise Server 15 SP4-LTSS:libexiv2-27 SUSE Linux Enterprise Server 15 SP4-LTSS:libexiv2-devel SUSE Linux Enterprise Server 15 SP4-LTSS:libexiv2-xmp-static SUSE Linux Enterprise Server 15-LTSS:exiv2 SUSE Linux Enterprise Server 15-LTSS:libexiv2-26 SUSE Linux Enterprise Server 15-LTSS:libexiv2-devel SUSE Linux Enterprise Server Teradata 12 SP3-LTSS:exiv2 SUSE Linux Enterprise Server Teradata 12 SP3:exiv2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:exiv2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libexiv2-12 SUSE Linux Enterprise Server for SAP Applications 12 SP4:exiv2 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libexiv2-12 SUSE Linux Enterprise Server for SAP Applications 12 SP5:exiv2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:exiv2 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libexiv2-26 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libexiv2-devel SUSE Linux Enterprise Server for SAP Applications 15 SP2:exiv2 SUSE Linux Enterprise Server for SAP Applications 15 SP2:libexiv2-26 SUSE Linux Enterprise Server for SAP Applications 15 SP2:libexiv2-devel SUSE Linux Enterprise Server for SAP Applications 15 SP3:exiv2 SUSE Linux Enterprise Server for SAP Applications 15 SP3:libexiv2-26 SUSE Linux Enterprise Server for SAP Applications 15 SP3:libexiv2-devel SUSE Linux Enterprise Server for SAP Applications 15 SP4:exiv2 SUSE Linux Enterprise Server for SAP Applications 15 SP4:exiv2-0_26 SUSE Linux Enterprise Server for SAP Applications 15 SP4:libexiv2-26 SUSE Linux Enterprise Server for SAP Applications 15 SP4:libexiv2-27 SUSE Linux Enterprise Server for SAP Applications 15 SP4:libexiv2-devel SUSE Linux Enterprise Server for SAP Applications 15 SP4:libexiv2-xmp-static SUSE Linux Enterprise Software Development Kit 12 SP5:exiv2 SUSE Linux Enterprise Software Development Kit 12 SP5:libexiv2-devel SUSE OpenStack Cloud 9:exiv2 SUSE OpenStack Cloud 9:libexiv2-12 SUSE OpenStack Cloud Crowbar 9:exiv2 SUSE OpenStack Cloud Crowbar 9:libexiv2-12 moderate 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N