CVE-2021-32617

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An inefficient algorithm (quadratic complexity) was found in Exiv2 versions v0.27.3 and earlier. The inefficient algorithm is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4. Note that this bug is only triggered when _writing_ the metadata, which is a less frequently used Exiv2 operation than _reading_ the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `rm`.

• CWE-400

• https://github.com/Exiv2/exiv2/pull/1657Patch, Third Party Advisory
• https://github.com/Exiv2/exiv2/security/advisories/GHSA-w8mv-g8qq-36mjPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5I3RRZUGSBIUYZ5TIHLN55PKMAWCSJ5G/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2BPQNJKTRIDINTVJ22QMMTIZEPHVKXK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQAKFIQHW2AS3AGSJM42ABOA6CWIJBGM/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZ5SGWHK64TB7ADRSVBGHEPDFN5CSOO3/
• https://security.gentoo.org/glsa/202312-06
• https://github.com/Exiv2/exiv2/pull/1657Patch, Third Party Advisory
• https://github.com/Exiv2/exiv2/security/advisories/GHSA-w8mv-g8qq-36mjPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5I3RRZUGSBIUYZ5TIHLN55PKMAWCSJ5G/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2BPQNJKTRIDINTVJ22QMMTIZEPHVKXK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQAKFIQHW2AS3AGSJM42ABOA6CWIJBGM/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZ5SGWHK64TB7ADRSVBGHEPDFN5CSOO3/
• https://security.gentoo.org/glsa/202312-06

Published

May 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32611A NULL pointer dereference vulnerability exists in eXcall_ap…7.5
• CVE-2021-32612The VeryFitPro (com.veryfit2hr.second) application 3.2.8 for…8.1
• CVE-2021-32613In radare2 through 5.3.0 there is a double free vulnerabilit…5.5
• CVE-2021-32614A flaw was found in dmg2img through 20170502. fill_mishblk()…7.1
• CVE-2021-32615Piwigo 11.4.0 allows admin/user_list_backend.php order[0][di…9.8
• CVE-2021-326161CDN is open-source file sharing software. In 1CDN before co…6.1
• CVE-2021-32618The Python "Flask-Security-Too" package is used for adding s…6.1
• CVE-2021-32619Deno is a runtime for JavaScript and TypeScript that uses V8…9.8
• CVE-2021-3262TripSpark VEO Transportation-2.2.x-XP_BB-20201123-184084 Nov…9.8
• CVE-2021-32620XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2021-32621XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2021-32622Matrix-React-SDK is a react-based SDK for inserting a Matrix…7.8