Exiv2: [GHSA-3695-mjv8-3r52: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (WebReady/Curl builds)] (CVE-2026-68546)

CVE-2026-68546 describes a heap out-of-bounds write vulnerability in the RemoteIo module of Exiv2 when it processes data from a malicious remote server, specifically in WebReady/Curl builds. This vulnerability could potentially lead to memory corruption. The affected versions are explicitly listed and include various Ubuntu package versions of Exiv2 0.25, 0.27.x, and 0.28.x releases. No CVSS score or detailed exploit information is provided, and no known exploits are reported in the wild.

The vulnerability allows a heap out-of-bounds write which may cause memory corruption when Exiv2 reads from a malicious remote server. This could potentially lead to application crashes or other undefined behavior. No confirmed exploitation or further impact details are available.

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing data from untrusted remote servers with vulnerable Exiv2 versions.