Exiv2: [GHSA-jcgh-p9v3-pw6j: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files] (CVE-2026-68547)

CVE-2026-68547 is a vulnerability in Exiv2 involving a heap out-of-bounds read in the RemoteIo module triggered when processing block-aligned remote CRW files. This flaw could potentially lead to memory safety issues during file parsing. The vulnerability affects a range of explicitly enumerated Exiv2 package versions, primarily those distributed in various Ubuntu releases. No CVSS score is provided, and there is no indication of known exploits in the wild.

The vulnerability allows a heap out-of-bounds read which may cause application crashes or potentially expose sensitive memory contents. No direct evidence of exploitation or elevated impact such as code execution is provided. The impact is therefore limited to possible denial of service or information disclosure under specific conditions when handling remote CRW files.

No explicit patch or remediation details are provided in the available data. Users should consult the vendor or distribution advisories for updates or fixes. Until a patch is confirmed, avoid processing untrusted block-aligned remote CRW files with affected versions of Exiv2.