CVE-2020-18899: EXIV2

Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days.

An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of service (DOS) via a crafted input.

Affected products

• EXIV2 EXIV2: version 0.27 only

Published 2021-08-19. Last modified 2026-06-17.