High severity · published Jul 17, 2018
CVE-2018-14338
samples/geotag.cpp in the example code of Exiv2 0.26 misuses the realpath function on POSIX platforms (other than Apple platforms) where glibc is not used, possibly leading to a…
8.1
CVSS
1.4%
EPSS
No
On KEV
Description
samples/geotag.cpp in the example code of Exiv2 0.26 misuses the realpath function on POSIX platforms (other than Apple platforms) where glibc is not used, possibly leading to a buffer overflow.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EX
Exiv2 · Exiv2
0.26 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-14338
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-14338
Exploit
https://github.com/Exiv2/exiv2/issues/382
More from Exiv2
9.8
CVE-2025-26623
Use After Free in Exiv2
9.8
CVE-2018-11531
Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp
8.8
CVE-2023-44398
Out-of-bounds write in exiv2
8.8
CVE-2019-9143
An issue was discovered in Exiv2 0.27
8.8
CVE-2019-9144
An issue was discovered in Exiv2 0.27