LiveActive security incident?Get immediate response
CVE Record

CVE-2021-34335: Denial of service due to FPE in Exiv2::Internal::resolveLens0xffff

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A floating point exception (FPE) due to an integer divide by zero was found in Exiv2 versions v0.27.4 and earlier. The FPE is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the interpreted (translated) data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p t` or `-P t`). The bug is fixed in version v0.27.5.

MediumCVSS 4.7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-34335 can crash Exiv2 when it prints translated metadata from a crafted image. Business impact is denial of service in workflows that process untrusted images with affected Exiv2 versions. It does not indicate data theft or code execution in the supplied sources.

Executive priority

Treat as a targeted availability risk, not a broad compromise risk. Patch promptly where Exiv2 touches untrusted images or automated media pipelines; handle isolated desktop use through normal update cycles.

Technical view

Exiv2 versions 0.27.4 and earlier contain an integer divide-by-zero in Exiv2::Internal::resolveLens0xffff, producing a floating point exception. The vulnerable path is reached when printing interpreted metadata, a less common operation requiring translated-data printing. The issue is fixed in 0.27.5.

Likely exposure

Exposure is most likely in image ingestion, media processing, forensics, CMS, or desktop workflows that use Exiv2 0.27.4 or earlier on untrusted files and print translated metadata.

Exploitation context

The source bundle describes a crafted image causing denial of service if a victim runs Exiv2 on it. CISA KEV is false, and no supplied source confirms active exploitation.

Researcher notes

The vulnerability maps to CWE-369 and CVSS 3.1 score 4.7. Evidence identifies affected versions, trigger conditions, and the fixed release, but does not provide confirmed exploitation or broader product impact beyond Exiv2.

Mitigation direction

  • Upgrade Exiv2 to version 0.27.5 or later.
  • Apply Fedora, Gentoo, or other vendor-packaged security updates where applicable.
  • Reduce processing of untrusted images by affected Exiv2 versions.
  • Avoid translated metadata printing in exposed workflows until patched.
  • Check vendor guidance if using backported distribution packages.

Validation and detection

  • Inventory systems and containers with Exiv2 installed.
  • Identify linked applications using the Exiv2 C++ library.
  • Review workflows that print interpreted or translated image metadata.
  • Confirm package versions or vendor backport status.
  • Prioritize systems processing external image uploads.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-369: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-34335 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.7 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.7CVSS 3.1MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H13.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

4.7Medium
CVSS 3.1 vector shape for CVE-2021-34335Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Exiv2exiv2<= 0.27.4Listed
Weakness

CWE details

CWE-369

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-369 · source CWE mapping

Divide By Zero

Divide By Zero represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs