CVE-2026-38332
TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length.
Scoring
- Severity
- LOW
- CVSS base score
- 2.9
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- EPSS probability
- 0.12%
- CWE
- CWE-125
- Published
- 2026-09-13
- Last modified
- 2026-09-14
Affected products
- cdcseacave TinyEXIF
Weakness type
Related vulnerabilities
- CVE-2026-78989 — Out of bounds read in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potential
- CVE-2026-87650 — Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arb
- CVE-2026-82072 — Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code ins
- CVE-2026-78978 — Out of bounds read in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potential
- CVE-2026-87440 — Out of bounds read in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code
- CVE-2026-87604 — Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the re
- CVE-2026-79020 — Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory
- CVE-2026-55211 — surfio IRAP header size fields cause out-of-bounds reads