An uncaught exception in the preview component of the Exiv2 library is triggered by an integer overflow when Exiv2 is run with the -pp argument, causing the program to attempt to allocate a std::vector larger than the maximum allowed size and crash. This fault results in an abrupt termination of the program and corresponds to CWE‑248, indicating that unchecked conditions can lead to resource exhaustion or program instability.

All installations of the Exiv2 library and command‑line utility using versions earlier than 0.28.8 are affected; the flaw is present across all supported operating systems on which the library is compiled.

The CVSS base score of 2.7 reflects a low overall severity, and the EPSS score of less than 1 % suggests a very low probability of exploitation. The vulnerability is not included in the CISA KEV catalog. Exploitation requires local access to invoke Exiv2 with the -pp flag, so it is limited to environments where an attacker can supply arbitrary command‑line arguments. While the immediate risk is low, the crash can be leveraged to disrupt services that rely on Exiv2 for image metadata handling, resulting in a denial‑of‑service condition.