{"id":"CVE-2024-39695","summary":"Exiv2 has an out-of-bounds read in AsfVideo::streamProperties","details":"Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.2. The vulnerability is in the parser for the ASF video format, which was a new feature in v0.28.0. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted video file. The bug is fixed in version v0.28.3.","aliases":["GHSA-38rv-8x93-pvrh"],"modified":"2026-08-12T15:13:04.765902Z","published":"2024-07-08T15:14:27.639Z","related":["SUSE-SU-2026:20923-1","openSUSE-SU-2024:14184-1","openSUSE-SU-2026:20410-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39695.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39695.json"},{"type":"ADVISORY","url":"https://github.com/Exiv2/exiv2/security/advisories/GHSA-38rv-8x93-pvrh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39695"},{"type":"FIX","url":"https://github.com/Exiv2/exiv2/commit/3a28346db5ae1735a8728fe3491b0aecc1dbf387"},{"type":"FIX","url":"https://github.com/Exiv2/exiv2/pull/3006"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/exiv2/exiv2","events":[{"introduced":"931a40a746f5678dcc4625b06a2eb25fa4f00b34"},{"fixed":"a6a79ef064f131ffd03c110acce2d3edb84ffa2e"},{"fixed":"3a28346db5ae1735a8728fe3491b0aecc1dbf387"}],"database_specific":{"cpe":"cpe:2.3:a:exiv2:exiv2:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.28.0"},{"fixed":"0.28.3"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v0.28.2","v0.28.1","v0.28.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-39695.json","vanir_signatures_modified":"2026-08-12T15:13:04Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/exiv2/exiv2/commit/3a28346db5ae1735a8728fe3491b0aecc1dbf387","target":{"file":"src/asfvideo.cpp","function":"AsfVideo::decodeHeader"},"deprecated":false,"digest":{"function_hash":"88257935135984982867312839615291411079","length":462},"id":"CVE-2024-39695-1514c7b9"},{"id":"CVE-2024-39695-6194433b","signature_type":"Function","signature_version":"v1","source":"https://github.com/exiv2/exiv2/commit/3a28346db5ae1735a8728fe3491b0aecc1dbf387","target":{"file":"src/asfvideo.cpp","function":"AsfVideo::streamProperties"},"deprecated":false,"digest":{"function_hash":"105428784746860063348776894588523176421","length":796}},{"target":{"file":"src/asfvideo.cpp","function":"AsfVideo::HeaderReader::HeaderReader"},"deprecated":false,"digest":{"length":284,"function_hash":"197739322505638074381697842375351231248"},"id":"CVE-2024-39695-90b89573","signature_type":"Function","signature_version":"v1","source":"https://github.com/exiv2/exiv2/commit/3a28346db5ae1735a8728fe3491b0aecc1dbf387"},{"source":"https://github.com/exiv2/exiv2/commit/3a28346db5ae1735a8728fe3491b0aecc1dbf387","target":{"file":"src/asfvideo.cpp"},"deprecated":false,"digest":{"line_hashes":["13709010422328940566935468869600840908","138267457726336358452953641749099982036","32756204079311668524520428415165430453","163390997209723102112502485388277307790","256408642367862661417005747270226218651","247493202791271579436704242321447121037","116340123415061569803052037942618544871","220676755723957842662119383124569319949","89245176066610528953585745847721665783","107507256365929353274579992926613901568","112669508820060460455340539953948510540","2998631293118311015131258849003353552","145935274615714093797826044317601517716","171555698996535444213340730528565332896","334579226884254530013434655253375999433","198869315890836333941229801748849961187"],"threshold":0.9},"id":"CVE-2024-39695-cb6cc373","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/exiv2/exiv2/commit/3a28346db5ae1735a8728fe3491b0aecc1dbf387","target":{"file":"src/asfvideo.cpp","function":"AsfVideo::fileProperties"},"deprecated":false,"digest":{"function_hash":"129008512560735208213800617324848643838","length":661},"id":"CVE-2024-39695-ff6319bb"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}