How severe is CVE-2021-34335?

CVE-2021-34335 has a CVSS 3.x base score of 4.7, rated medium severity. It is exploitable over local access with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2021-34335 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (58th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-34335?

CVE-2021-34335 primarily affects Exiv2. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2021-34335?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-34335 published?

CVE-2021-34335 was published on 2021-08-09 and last updated on 2026-06-17.

CVE-2021-34335

CVE-2021-34335 is a medium-severity vulnerability in Exiv2 with a CVSS 3.x base score of 4.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-369.

Key facts

Severity: Medium (CVSS 3.x base score 4.7)
CVSS v2: 4.3
EPSS exploit prediction: 1% (58th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-369
Affected product: Exiv2
Published: 2021-08-09
Last modified: 2026-06-17

Description

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A floating point exception (FPE) due to an integer divide by zero was found in Exiv2 versions v0.27.4 and earlier. The FPE is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the interpreted (translated) data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p t` or `-P t`). The bug is fixed in version v0.27.5.

Frequently asked questions

What is CVE-2021-34335?: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A floating point exception (FPE) due to an integer divide by zero was found in Exiv2 versions v0.27.4 and earlier. The FPE is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the interpreted (translated) data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p t` or `-P t`). The bug is fixed in version v0.27.5.
How severe is CVE-2021-34335?: CVE-2021-34335 has a CVSS 3.x base score of 4.7, rated medium severity. It is exploitable over local access with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2021-34335 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (58th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-34335?: CVE-2021-34335 primarily affects Exiv2. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2021-34335?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-34335 published?: CVE-2021-34335 was published on 2021-08-09 and last updated on 2026-06-17.

References

Affected products (3)

cpe:2.3:a:exiv2:exiv2:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

More vulnerabilities in Exiv2

CVE-2025-26623 — Critical (CVSS 9.8): Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image…
CVE-2018-11531 — Critical (CVSS 9.8): Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.
CVE-2023-44398 — High (CVSS 8.8): Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image…
CVE-2019-9144 — High (CVSS 8.8): An issue was discovered in Exiv2 0.27. There is infinite recursion at BigTiffImage::printIFD in the file…
CVE-2019-9143 — High (CVSS 8.8): An issue was discovered in Exiv2 0.27. There is infinite recursion at Exiv2::Image::printTiffStructure in the file…
CVE-2018-14046 — High (CVSS 8.8): Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.

All CVEs affecting Exiv2 →

Other CWE-369 (Divide By Zero) vulnerabilities

CVE-2021-32494 — Critical (CVSS 10.0): Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function. This allow attackers to create…
CVE-2017-11720 — Critical (CVSS 9.8): There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file.
CVE-2020-20892 — High (CVSS 8.8): An issue was discovered in function filter_frame in libavfilter/vf_lenscorrection.c in Ffmpeg 4.2.1, allows attackers…
CVE-2025-4637 — High (CVSS 8.7): Divide By Zero vulnerability in davisking dlib allows remote attackers to cause a denial of service via a crafted…
CVE-2026-37232 — High (CVSS 8.6): An issue was discovered in OpenAirInterface5G 2.4.0 (nr-softmodem) in the E2SM-KPM RAN Function's PRB utilization…
CVE-2024-26945 — High (CVSS 8.4): In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - Fix nr_cpus < nr_iaa case If…

Browse all CWE-369 (Divide By Zero) vulnerabilities →