A heap out-of-bounds write vulnerability exists in Exiv2's RemoteIo component when reading data from a malicious remote server in WebReady/Curl builds. This issue is tracked as CVE-2026-68546 and affects multiple specific versions of Exiv2. The severity is assessed as medium based on the available information.