Exempi is a metadata-handling library embedded in document processors, media tools, and creative applications, where its narrow product scope belies substantial downstream reach through tight integration into software supply chains. The vendor's disclosures center on the XMP parsing engine and recur through weakness classes including infinite loops, NULL-pointer dereferences, out-of-bounds reads and writes, and improper input validation—structural flaws typical of native parsers handling untrusted document metadata. Defenders should track Exempi updates as part of inventory for any document or media processing pipeline; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Exempi Project over time
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-12648HIGH The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference. | Jun 22, 2018 | 7.5 | 24 | NO | NO |
CVE-2017-18234HIGH An issue was discovered in Exempi before 2.4.3. It allows remote attackers to cause a denial of service (invalid memcpy with resultant use-after-free) or possibly have unspecified | Mar 15, 2018 | 7.8 | 24 | NO | NO |
CVE-2020-18652MEDIUM Buffer Overflow vulnerability in WEBP_Support.cpp in exempi 2.5.0 and earlier allows remote attackers to cause a denial of service via opening of crafted webp file. | Aug 22, 2023 | 6.5 | 21 | NO | NO |
CVE-2020-18651MEDIUM Buffer Overflow vulnerability in function ID3_Support::ID3v2Frame::getFrameValue in exempi 2.5.0 and earlier allows remote attackers to cause a denial of service via opening of cra | Aug 22, 2023 | 6.5 | 21 | NO | NO |
CVE-2018-7731MEDIUM An issue was discovered in Exempi through 2.4.4. XMPFiles/source/FormatSupport/WEBP_Support.cpp does not check whether a bitstream has a NULL value, leading to a NULL pointer deref | Mar 6, 2018 | 5.5 | 20 | NO | NO |
CVE-2018-7730MEDIUM An issue was discovered in Exempi through 2.4.4. A certain case of a 0xffffffff length is mishandled in XMPFiles/source/FormatSupport/PSIR_FileWriter.cpp, leading to a heap-based b | Mar 6, 2018 | 5.5 | 20 | NO | NO |
CVE-2017-18238MEDIUM An issue was discovered in Exempi before 2.4.4. The TradQT_Manager::ParseCachedBoxes function in XMPFiles/source/FormatSupport/QuickTime_Support.cpp allows remote attackers to caus | Mar 15, 2018 | 5.5 | 19 | NO | NO |
CVE-2017-18236MEDIUM An issue was discovered in Exempi before 2.4.4. The ASF_Support::ReadHeaderObject function in XMPFiles/source/FormatSupport/ASF_Support.cpp allows remote attackers to cause a denia | Mar 15, 2018 | 5.5 | 19 | NO | NO |
CVE-2017-18235MEDIUM An issue was discovered in Exempi before 2.4.3. The VPXChunk class in XMPFiles/source/FormatSupport/WEBP_Support.cpp does not ensure nonzero widths and heights, which allows remote | Mar 15, 2018 | 5.5 | 19 | NO | NO |
CVE-2018-7729MEDIUM An issue was discovered in Exempi through 2.4.4. There is a stack-based buffer over-read in the PostScript_MetaHandler::ParsePSFile() function in XMPFiles/source/FileHandlers/PostS | Mar 6, 2018 | 5.5 | 19 | NO | NO |
Signals from CVEs in this vendor scope (13 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Exempi Project.
Media articles that mention a CVE ID that affects a product developed by Exempi Project — matched by CVE ID, not by vendor name.