-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Exiv2 | pip | >= 0.28.0, < 0.28.5 | 0.28.5 |
PythonPythonMiggo AIRoot Cause AnalysisThe ASAN trace in GitHub issue #3168 shows a heap-use-after-free in TiffComponent::accept() at tiffcomposite_int.cpp:628. The fix in PR #3174 addresses ownership issues by reverting faulty copy constructors, indicating improper pointer management in TIFF component handling. The vulnerability manifests during metadata encoding via TiffParser::encode, which traverses components using visitors. TiffSubIfd's acceptance of visitors after being freed (due to missing ownership transfers) is the root cause.
KEV Misses 88% of Exploited CVEs- Get the report