Security readout for executives and security teams
Plain-English summary
CVE-2017-11340 is a crash bug in Exiv2 0.26, a metadata parsing library. A maliciously crafted input can trigger a segmentation fault and cause denial of service. Business impact depends on whether Exiv2 processes untrusted images or metadata in production workflows.
Executive priority
Treat this as a targeted availability risk. It is not presented as code execution, but vulnerable internet-facing media workflows could be disrupted by malformed files.
Technical view
The CVE describes a segmentation fault in Exiv2 0.26 in XmpParser::terminate(), related to an exit call. The stated impact is remote denial of service from crafted input. The bundle does not provide CVSS, CWE, fixed versions, or detailed affected package data.
Likely exposure
Exposure is most likely where Exiv2 0.26 parses untrusted media metadata, such as upload pipelines, image processing services, CMS tooling, or automated file ingestion. The provided affected-product metadata is incomplete.
Exploitation context
The source bundle supports denial of service via crafted input. It does not support claims of active exploitation, public exploit availability, privilege escalation, code execution, or CISA KEV listing.
Researcher notes
Evidence is sparse. The CVE record names Exiv2 0.26 and XmpParser::terminate(), with a Red Hat Bugzilla reference, but no CVSS, CWE, patch version, or detailed root-cause analysis in the bundle.
Mitigation direction
- Inventory systems and applications using Exiv2 0.26.
- Check Exiv2, OS vendor, and Red Hat guidance for fixed packages.
- Prioritize services that parse user-supplied images or metadata.
- Isolate or sandbox metadata processing for untrusted files.
- Restrict or queue untrusted media parsing until remediated.
Validation and detection
- Check package inventories, SBOMs, and container images for Exiv2 0.26.
- Identify applications dynamically or statically linked to libexiv2.
- Map untrusted upload and file-ingestion paths using Exiv2.
- Confirm vendor package status against official advisories.
- Verify crash resilience in controlled, non-production parser tests.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-11340 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.redhat.com/show_bug.cgi?id=1470950CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.