{"id":"CVE-2026-38332","details":"TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length.","aliases":["GHSA-jqj2-8c2j-gx82"],"modified":"2026-09-14T14:19:23.146611Z","published":"2026-09-13T00:00:00Z","database_specific":{"cna_assigner":"mitre","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/38xxx/CVE-2026-38332.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/38xxx/CVE-2026-38332.json"},{"type":"REPORT","url":"https://github.com/cdcseacave/TinyEXIF/issues/24"},{"type":"FIX","url":"https://github.com/cdcseacave/TinyEXIF/pull/25"},{"type":"ADVISORY","url":"https://github.com/cdcseacave/TinyEXIF/security/advisories/GHSA-jqj2-8c2j-gx82"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38332"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cdcseacave/tinyexif","events":[{"introduced":"0"},{"fixed":"8c22aff20f289a9ced263e43868e6c53c60c6fe2"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.1.0"}],"source":"AFFECTED_FIELD"}}],"versions":["1.0.4","1.0.3","1.0.2","1.0.1","1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-38332.json","vanir_signatures_modified":"2026-09-14T14:19:23Z","vanir_signatures":[{"source":"https://github.com/cdcseacave/tinyexif/commit/8c22aff20f289a9ced263e43868e6c53c60c6fe2","target":{"file":"TinyEXIF.cpp","function":"EXIFInfo::parseIFDMakerNote"},"deprecated":false,"digest":{"function_hash":"70963434092715790970285422698334690723","length":1054},"id":"CVE-2026-38332-1c2c0b03","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"178598498564532788464263377067188204620","length":1145},"id":"CVE-2026-38332-1eb59949","signature_type":"Function","signature_version":"v1","source":"https://github.com/cdcseacave/tinyexif/commit/8c22aff20f289a9ced263e43868e6c53c60c6fe2","target":{"function":"EXIFInfo::parseIFDImage","file":"TinyEXIF.cpp"}},{"digest":{"line_hashes":["332015734198596021326702516667145624503","226024239913069485333526744679345545917","121258602004834234298136316634547298595","216047489409572056196328177305748315222","254439527960335929691895139906557229738","62973997337597954910308565489747903567","319754939307154454727516796628730978761","243342968029933926065953836055358632425","106027708079389287841259404137908276264","6986036424291656040984960902234566504","275910999920162475174924979492704918805","309149061284976721889507914034452803289","19000356443942204715315848088131231570","39361813629173053635823745545427501882","49994891745018861551436691534213096529","305551267392997613536553677239805566763","6159269972630473806479912849312696218","108305448859820783044475395825388622588","92971119925279549944559621365696656722","131449375014778099258212859445614309370","2913710959561879887885878404107581821","97415822543470230475171241173552363312","193694663445664088807699249592890987919","225345219580666860976411134648437109795","189746831505116109955143034627180983655","254258520895449720961986444643207486242","249598348942684010174682628435619217718","314697208386918302520965477806277241466","250532505213382602920179278126934958865"],"threshold":0.9},"id":"CVE-2026-38332-41621bed","signature_type":"Line","signature_version":"v1","source":"https://github.com/cdcseacave/tinyexif/commit/8c22aff20f289a9ced263e43868e6c53c60c6fe2","target":{"file":"TinyEXIF.h"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"219559251586259510400048967144128617878","length":7596},"id":"CVE-2026-38332-59744a5c","signature_type":"Function","signature_version":"v1","source":"https://github.com/cdcseacave/tinyexif/commit/8c22aff20f289a9ced263e43868e6c53c60c6fe2","target":{"file":"main.cpp","function":"main"}},{"deprecated":false,"digest":{"line_hashes":["336411948672744840348017108735197914286","205474738848107441158013592908629458552","1353401711710548992581669732005150245","174555328685482614998460846112017201397","225142199736519517209550156327327027502","19846798922452030971603753320706097356","309235230306416970938672324253542710411","72150475834852027616609617439209734757","278077555243837414147462611658427436944","32559793925006062216815633318105565682","49902671947912722676051455805510158561","128811108240551427797422268909439010093","309018807053018621216635972804566462623","32154763128770380312715077251522397886","5514155140492108082632521682879271092","281989417378405743904750482924640107913","188471218911138089019923693231984481862","240498576372052749643921024385156425754","55712130061651082152583303733531866046","286498108840453419623952114105072861382","248687009703755655727486130933802718548","22565332594812511079662295718566322784"],"threshold":0.9},"id":"CVE-2026-38332-5aa2539f","signature_type":"Line","signature_version":"v1","source":"https://github.com/cdcseacave/tinyexif/commit/8c22aff20f289a9ced263e43868e6c53c60c6fe2","target":{"file":"main.cpp"}},{"digest":{"function_hash":"323767906184021612874573447781734090856","length":6485},"id":"CVE-2026-38332-5b96a814","signature_type":"Function","signature_version":"v1","source":"https://github.com/cdcseacave/tinyexif/commit/8c22aff20f289a9ced263e43868e6c53c60c6fe2","target":{"file":"TinyEXIF.cpp","function":"EXIFInfo::parseFromXMPSegmentXML"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/cdcseacave/tinyexif/commit/8c22aff20f289a9ced263e43868e6c53c60c6fe2","target":{"file":"TinyEXIF.cpp","function":"EXIFInfo::Geolocation_t::parseCoords"},"deprecated":false,"digest":{"function_hash":"105552891108878848542217986013272153873","length":675},"id":"CVE-2026-38332-5f6cc8dc","signature_type":"Function"},{"source":"https://github.com/cdcseacave/tinyexif/commit/8c22aff20f289a9ced263e43868e6c53c60c6fe2","target":{"file":"TinyEXIF.cpp","function":"EXIFInfo::parseIFDGPS"},"deprecated":false,"digest":{"function_hash":"167568844496140095229672437463425832013","length":1464},"id":"CVE-2026-38332-88972c27","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/cdcseacave/tinyexif/commit/8c22aff20f289a9ced263e43868e6c53c60c6fe2","target":{"file":"TinyEXIF.cpp"},"deprecated":false,"digest":{"line_hashes":["330907307215734906579025928969644182801","42679315932571717432078313323766879038","311169261371230539065526612810888990586","61524858411571230335502759670571669542","154323817445536412396271993044979540227","127434548821695516461495387476565201154","334005503788597759118561460413310325275","27653395152700036197568379794523976563","318484892184158637109051371452868524446","105923819981970141071885446700654322454","303115216603870790953717455383599436820","32694260190460374691543282290069351662","310673306121219588489805509917040552042","330131888992985984479875339174018394122","292907426084800512305543140729564075633","232936743556298815530767519332200205046","19294010761802220673768475627325840774","247190286891445222781310773588218881830","338120278930184393610084046643621987573","269773765098012973745074116341443746302","179584941661524833584891434330302797216","61920407286974452716500193408793740272","142631744921955041393050058217492048590","277438866256747771868561752040744748624","254224657404345334518930751784689710678","312321590109403744440849720129883031056","59088696236639028119459773609782595694","274873227777925906300991022452620763872","96725148681906023890200244618066438316","50220755209444414102371991660514201771","158075211494709458338836943562741825763","327775986032216726974511935124944842237","197590905008196059164594737827369830212","155395373139094576395914213668630334575","59084256832663177804386601320720942323","173793988505239484658263838903889846442","219501331868613642351203050805650560041","308381442573124767511020342143111759451","84128704029601629097504775864205470521","49822282168374210824467106113289785216","157300294775866664811709657329050356921","283786863891867295376004010488454540888","79830022709755087504556845581494713069","234705318970487858887253198961040865123","119822244623432758800895760567326601051","217265982984278521090698085271899615959","231363595602665612891487732030620223663","72785724921321047415376505981703401945","91492834287714390839321445476954352619","36951273340798319325168387674155514605","146446376001107332669423750759906003898","249674179072502881531095346459316807234","43927240142010590221910580538519729694","90648895208653869971379825819418994769","57618773451563832302402144374927767028","142683249595939231745383943927747442540","334699070566054475546617807302069435038","222794292915728339640827104434476967366","92329884167592028641774116877383093545","20191020943273380521571702477433603895","228858191824297323341084991834492534493","80835868031729721476691239420834857520","62592283810809750740983295432369156864","281650259337830797442047856699227374726","77797490771218759858180195170129399860","49772218586875907569470762606009185775","88722504587762036264149265049107867508","84329232919828439180515285691399445591","281529198309064741445293014772766769943","172289063787917049119175434211221536154","230681192759700275901415665513776361483","84297752258734187743394024248883962070","96090786854680326041390131094590305585","237288153497491359278992958866069919189","189746238957385360436143178753213050785","82308273801391590607220305647322063424","7342020265446596522028596694033872741","96380353838868724561810249373580873695","331502268240501900896050357446539226868","128296733279719841753287820313640050182","284750120395118739215743206131554669201","310289736886432184718825980124774258768","145243951490631180630115788302727845463","16781268812925412102347436639299697103","15300666438839686564625085548791526609","86654057054379247143847019180347637638","316391769049320730569342843129571886839","307594589777543619635916082768760785670","219728798193552864180350883227444970538","336358891688491903938517592815823366473","172049047487845200810589042363910485153","231800497338463516093546448912344387630","170960254524813768011582021232997330536","109188312615547942709555988877286519898","285618726038089493748325901010931464504","55196946609539761198199940775705878300","93343612187409872350655724407289855159","212880501696424917919292651974624458063","108761875013301958384713917594437904177","125064472214682172875826108024094744816","32251658430489630475644293378937165241","208497099625321789191888651733508142748","338735649908416777312240634410722715002","37532866627485651872303725298161117450","132362196684978028981757272121782394768","32186424512860876965826639552724825811","90411001009119523934752690724051817140","218673797691208870070579363209009014402","142935089303513727670737941994162238467","88462749267630138435229691644425682509","140489892784590640703746576384976413258","241632988882540507452293974096835425142","75206598670427058655879269361114116386","119621774846378384143860650460341154288","107232651659467577591934041837630932297","104234169472619213967595623933558587773","57138924459915369551421275411095626459","14099592995508552395077016182238054362","3484986206814275131111900384491318731","223805271759284353866336469344513736661","98979765483733449660207943912347943828","239195217459400020139942320446982832116","155511064907547288529112423517193679751","219569906649290748896971385440585540040","143110515264678008324265157070122722334","194032718616439706116277924326052901475","87286766374573836898512688007597499711","227341876814241826824414330141905414834","3104138593022308742498416102787446859","48034867811026367060488516863542158039","195808083466777935796254155967852045674","218106489410752117084389245906817205592","314235356123984435279384119314338376627","292483325013711218685896396785036612081","223777318147254057900033267392559031423","35096431575818015025627445723878854121","205343229774268221425471977131089005984","102464021999124018495657430166523955679","292558622237489751528370436894111491528","191038252675108417643926474939576408484","333611926967210801424024086041405009285","104679891984595597696927330584862782996","320990036702484327441972916587413936952","265470420586488091676143233304570755548","146642449038614251912524481935968870969","74235877695909941056897569404683012581","140565624240177457730804533803727563234","136271353438112066407340938231092000441","42971923899369195344364247908427968726","129456638540206014365488404258864928973","63239185875691629290944630304458990696","270934536355308050559769274863510648420","19637725434334463793350002056392153812","122386924833360061194218192859521038908","102120911964022756928196487558012786756","297742619052727589131735772407602033618","123960804002316112549041462343360243101","220697375359162965616750610976825207934","186441764229202755160119571810396794746","325025044871016594855077822067516688890","321081435219725928791858372906821107414","143974769053470339657819515248362198096","70918764529839463803095329571028300052","136157323154864699564314347861487603198","239483100354184263494960639972551294220","1188309872103531783086795632960495979","90925365930338854893707082267513770135","7511206730779820727758787694757680693","287612318356308809429088612008507359149","307025088566431390058378982891267513672","30040456818424322446557127161951940358","277628383863061867254321850272144515418","22901003089317085350308566089823360532","162084117498235655907833672830698362757","103061406437340766955872587593854444931","233712465005746979209824708879278351390","222449892412054233624883607871580264740","209434192866362337117790474833707776034","46260100379638135235931147392241394864","65222019699605807726630594723952367422","254319178619864622226017839834964211062","135396467009069752630731031799811274244","49492679680987265666640005490393990812","130618793231685469237361045703422179930","114219565225205917121079995753470356183","31022630372483282810052394011032975739","268853052764083820599147653562048424198","128646997491515706324963493996412706685","324984414570379935978159273385406785879","131350845160024156220164292199867490287","7314592279914864700376810947140696231","30801896396299525700474294188045465567","307428787010546896380706801829656976996","109044234214776206663763658784264998832","234983299455515398143146556918169149909","309335182978509021733079444101508774142","276645017288160239104545001509059945011","266570342436671088722189034015623184921","177925498652326253766576265429352169313","232916742255300134642084836792096344285","152916355113383314059102255422194556823","183235282126247023230211067515710385211","87760875104606892471741958810135674183","24695326493604988016354056691054463152","76397475526140634264294216083415304070","110569070671545553174897170348790366416","140193445750991316361120244732990153750","72189030381239130681091873938215729463","279716401178435256503718620394847340614","241006891633850169525251207858696361929","293240252372908004260148653031097242647","172580173620099064705025625852557138955","250680405703273254065212073660975046919","87904516754979166767883325927874810568","181733224769290929977406372749306655519","117808216937226142705657491819263200364","110425292172758028732479379372935040462","222643578207773957012615202052396139572","96777694517995163182478211795312057585","29594435895452199900092581665226691310","267775819961026569121339217903572385585","300915140133920737608974734521219558209","256698849770031363181072206964577091867","16557102833753687625343114196194242375","259881697612982870235417159534726758996","154317035567157005760342019912681625071","180375823848847180975625570099860834491","108166431922148755492811230953443268011","325127066495788886689312357275214610716","187026888392444352006475668287065041830","97384260806134879631019888801328504958","272479560886479550233628621833939841179","330713909919674593753071453376426128889","119681612274523287311545396572547148701","85845441346562512705082223121068357209","179351178830376040337981081100117878519","320026490595841252609730104594849474397","191185700749511439225861515329786445925","191851862081436877277448429345643842934","118985614564039526418374626153912516555","226568458907478002573120501727847480130","280591414330321676389705428124436689883","254019685130629003242909267480387245104","151237171527106096750502652311211339315","130620194971981463033842841728799194540","43694965437338204921547841459807915047","6039818795118801377977338303721528760","229381380537590836200826991500044487212","135180613060877889633534357213259994861","170342906381241634944228543756450531820","138595518694136969894107292407174100459","123207703495613934871056249363083428235","35152317090557769185909105586864013576","64568519059677881319777495195368706951","252653256603487883892888600603973079877","155876635066764133663918467247343910417","315953441596706581100759477875661079682","152500777494127265595363855372786927910","300580180336144990970999317393859788070","215051216481818184856526730607380532430","80434194859393845742839661896370492601","140680005949653628076793345704753497528","93514724050476028817427758011494771850","148607496119984427566762408048984566248","273690368112319391574477403603731043512","152888317327948934539655757832329270087","104500278840358024769532082161014720108","40248409683113753117036120460657481983","79818844446846360107279497990598805713","47633673834876274029779508732388812173","124875406810278699547197258799435374629","1306087378880468474276195761535685334","105195449385186860361542873018366311040","290535565215654766649805219150668781546","254345599978723489792664068060102676566","149353652268212768164543833266746591713","287297066999552952821869562329622494685","269461731723506964405678805948981335569","74099299012729550093813340643918918046","139137468122169731739608702712708879233","3087469179368512896416210049044058921","130370945371904244383307790656568931262","136859298700774824975309468595993349701","151483358610182604995378340280806170628","14366372524288417974509761573049449696","265996262934473065637290421431361285424","317804046610760245118896949237449090148","257756961136688594418280526847032478377","18169220437718351530348774389319006153","168360181903089464768952457039086595315","270786022162049153360219859806620116286","14450733998619483634592356511053987500","280934319967628713834575034882085708453","200957268075221918211845117995347117877","309274841946658411454217724045817344354","192353326310985934133536530954551400537","118960900957493318631495024406904021590","163831322281478652353601866473380969590","14083907336892206796882910673139588069","31447935321110255954123236449845638151","87968203716125494707072316394990036534","238453576631696896563024744881838216899","164315755394770297395381891682914885493","177232856865004681893671943991950287484","183722033034016282441739226771245571349","275966588800197994172079900068774285417","262307501022491206162405267849498167714","332988618592637329394862722356308717748","240422358995953555466161511588954023957","267553016015336335075979403662169320569","53337401046334203979496667462061362810","214579878105054977734673553926607426923","7929514733884201634084038266760341542","268325478892438800012809551223084970573","271590843152371799618798182903694529287","74175394096400317958922987329520323265","26156034914564561051406266114494457838","85371693319821955307701289657584667963","303597669157602804618863537413279758763","259728173721399476658545466105022269082","157584694136063842012749176427109850775","89817641612301999684094321374817910913","246425840431872354298500676241060923063","27104878844305304879667746180270369377","111401601448168340234670931066608063329","124910803540832916089347892713915647890","32935179997437509830649320363538186409","174411945530888899908377988471185641342","85371693319821955307701289657584667963","303597669157602804618863537413279758763","259728173721399476658545466105022269082","280600760613477321214415453530679813591","71781186554668326187016154995001832572","113440152284988363552865906139475402582","80304688459552847032069814085117510827","197728362212868959568366126473702258311","26491284261723854501325461150677404987","65216461203399914878753437515831532302","190807307217030820003349857942469947319","197605251581120139350055604767016443377","311053719177065111492619341395160314594","127180617286481470112639673175727631014","161463862281224372548761485699423534691","301306998691058438129625028739404725766","40259588665881736929127985512241110478","309007589765615048876185540456382726223","28475600062008111101698029662166910192","91985448815186972517453907964670247281","181138654519599825220006170994273619624","84780764130102082184873262773840699210","298382599705976850782966864143535462955","20002627979913405449995974001257243272","255769499591328788316186737610728811166","228564787417191657951769381210519824600","7281298456271048736858031862965018451","284647452355567801755621456705826885929","89796058644650034424796445821806631260","195561211542214791078846861263680608190","157322802039313683052791079420671036838","161620263023840107220772067263656819609","272279852042441778412747181513335559929","19393651361725855404593685748259809014","335442336033188063026790629534906347416","336148854130970277641926694404109675079","159369096173327486941576208082756630662","100022102912410726045241259267618484313","227365078980189580432711644498235847275","94652174094775985883522983342813332384","1986998463494143134596359156132749215","306899121810692520026432266874075929441","280285362154369827637109687472882694642","31631198621652836705909641918079291584","181680536691809375094354603640590244171","53597805210518915871066828712089764978","290727519263843531697813918811730404969","59523262512262564490816033513719146054","82134538373683914959363630181401264145","254429108913312501815111232313435707818","242146353468411625810643191435480510631","228011814046268556761768994643763916199","323094699605429233502896596868414920399","251890471472723390598165125866411696045","310230050288803206776405753773361894987","287616954185360367831706525323037475462","131570374956810414323814093964811619128","207515267209912571309269950939569802466","243720954446866493173018121227555902608","325603281674399520913185280511146172398","43943308649273497338769377354413443528","158315463630091753644052746420277697901","296329744848683493367280418098391672308","134816100118491685032802910106903636687","4811634693442486571681105333296048111","42827106158734190483504531853786932233","29664984146673211710152130175925267728","332381639549782700611419403410721268966","167886530530634795113022168157334911185","240778323366611128848795479074406814371","165423073542677666495317943857247843800","283358056351788465683347523870604127566","77392171243745434061271931077341553592","134806989468363071276511449410797106382","300238298255257864771535515704412012058","51139788297732132831162704845670839161","146179204978533021667281369519881655958","62796779096435656938061301066308455507","16554202556764703869396852738613536854","177198730730064284791962617871296957782","198889917746906252201285628989698598406","230509516726264508631223876455042460238","163329880392509901883314620304707282019","30252258493992267324624849636770734746","180989034183878225296641174741799372037","234962557953886047719139275434508523120","250365386513816837202175601785018744763","328460276957120436720859493536856886522","18645753444166509165334164272093340424","134699822489386886278303767363772318116","215255056878494587283668710035253991447","89091023530645228530260559735576558236","272790541552571130739831622366562019385","136030211937578897531027462854246946516","284405286879839828322384958541305019827","7231933534177478972471288525419533070","13822013091640904157476150302641834642","44544930926299406162137338477445749434","52203274197566162448105748189810773866","293713789978214590783281256830050096713","12095303172172280212140781787214531704","85338983237423760700877613599524690786","24908684980605347056271957239937852717","257902649493220055478334658054668451147","273304820193577535078345792797710011603","100564056090503337711813539924901453469","149843551812310825929237669860620499958","199181221668086236385444132102881089548","122687611228711244675278330994583178443","163017826783248863593472617779470429538","143117049856652895682633540224534177400","144843682080965573153487640119115798851","287968859377132250703065355207449854000","134600895670649117193952892243708711006","230858482523862647378293895187978933551","162597647023229719221483015056238984611"],"threshold":0.9},"id":"CVE-2026-38332-94a15663","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/cdcseacave/tinyexif/commit/8c22aff20f289a9ced263e43868e6c53c60c6fe2","target":{"file":"TinyEXIF.cpp","function":"EXIFInfo::parseFromEXIFSegment"},"deprecated":false,"digest":{"function_hash":"223227816244031048345162064950336899805","length":1787},"id":"CVE-2026-38332-c5e58e4e","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"17233334073624979349579771659861258085","length":2492},"id":"CVE-2026-38332-e5e70307","signature_type":"Function","signature_version":"v1","source":"https://github.com/cdcseacave/tinyexif/commit/8c22aff20f289a9ced263e43868e6c53c60c6fe2","target":{"file":"TinyEXIF.cpp","function":"EXIFInfo::clear"},"deprecated":false},{"id":"CVE-2026-38332-fa2fd1ed","signature_type":"Function","signature_version":"v1","source":"https://github.com/cdcseacave/tinyexif/commit/8c22aff20f289a9ced263e43868e6c53c60c6fe2","target":{"file":"TinyEXIF.cpp","function":"EXIFInfo::parseIFDExif"},"deprecated":false,"digest":{"function_hash":"22964257571576302774322294196720370858","length":2899}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}