- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 30
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 5 excluded.
Web 1
- https://github.com/Exiv2/exiv2
Products and areas 11
- ICC profile handling and the colour metadata paths
- IPTC datasets and the record structure they sit in
- The BMFF reader that handles HEIF, AVIF and CR3 where the build enables it, since box sizes and offsets there come straight from the file
- The exiv2 command-line tool itself, including the print, extract and insert commands that scripts and batch pipelines run unattended
- The format front ends Exiv2 opens directly: JPEG, TIFF, PNG, WebP, PSD, JP2, GIF, BMP, TGA, EPS and the raw formats (CR2, CRW, NEF, ARW, RAF, RW2, ORF, PEF, SRW, DNG and their relatives)
- The maker-note decoders for every camera vendor Exiv2 supports, each of which parses a proprietary structure with its own offset conventions
- The policy accepts security issues in released Exiv2 through a private draft GitHub advisory, and draws one boundary: a defect that only reproduces on main or on a pre-release is treated as an ordinary bug. Everything below sits inside a release
- The public C++ API surface, covering the assumptions a downstream caller such as digiKam or darktable is entitled to make
- The TIFF and EXIF core: IFD walking, tag directory parsing, offset and count arithmetic, and the recursion between nested directories
- The write path: inserting, modifying and erasing metadata, which rewrites structures in place and is what a photo manager does on save
- XMP handling, including the packet scanner, the bundled XMP toolkit and the XML parsing behind it
Out of scope (5)
- Anything reproducible only on main or on a pre-release build, which the policy classifies as a regular issue
- Defects inside a third-party library Exiv2 links, unless Exiv2's own use of it is what makes them reachable
- Distribution patches and packaging rather than upstream Exiv2
- Downstream applications that call Exiv2, including KDE components, digiKam and darktable, which have their own trackers
- Public GitHub issues used for an unfixed security defect, when the policy provides a private draft advisory instead
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Open a draft security advisory on github.com/Exiv2/exiv2, which is what SECURITY.md asks for.
-
Reproduce against a released version.
-
Attach the file.
-
Name the entry point: the exiv2 command-line tool, a specific API call, or a downstream application that led you there
-
Say which build options were on.
-
Check the published advisory list before filing.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
Sorona credits this project with 30 CVEs, 5 of them recent. The individual records appear here after the next sync.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 5 Last 12 months 30 Lifetime Out-of-bounds read or write 40 % Heap overflow 25 % Integer overflow 20 % Denial of service 15 % Latest advisories Loading the feed Overview Exiv2 is the C++ library that reads and writes image metadata: EXIF, IPTC and XMP. It is what KDE, digiKam, darktable and Gwenview call when a photo is opened, and it is packaged wherever a photo manager is. Metadata parsing has a track record worth respecting. CVE-2021-22204 turned a crafted metadata field in ExifTool into remote code execution on the server that processed the file. Exiv2 has thirty advisories of its own and runs a mature draft-advisory process that keeps the discussion private until a fix ships. No part of that process involves payment, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy accepts security issues in released Exiv2 through a private draft GitHub advisory, and draws one boundary: a defect that only reproduces on main or on a pre-release is treated as an ordinary bug. Everything below sits inside a release The TIFF and EXIF core: IFD walking, tag directory parsing, offset and count arithmetic, and the recursion between nested directories The maker-note decoders for every camera vendor Exiv2 supports, each of which parses a proprietary structure with its own offset conventions XMP handling, including the packet scanner, the bundled XMP toolkit and the XML parsing behind it IPTC datasets and the record structure they sit in ICC profile handling and the colour metadata paths The format front ends Exiv2 opens directly: JPEG, TIFF, PNG, WebP, PSD, JP2, GIF, BMP, TGA, EPS and the raw formats (CR2, CRW, NEF, ARW, RAF, RW2, ORF, PEF, SRW, DNG and their relatives) The BMFF reader that handles HEIF, AVIF and CR3 where the build enables it, since box sizes and offsets there come straight from the file The write path: inserting, modifying and erasing metadata, which rewrites structures in place and is what a photo manager does on save The exiv2 command-line tool itself, including the print, extract and insert commands that scripts and batch pipelines run unattended The public C++ API surface, covering the assumptions a downstream caller such as digiKam or darktable is entitled to make Out of scope Anything reproducible only on main or on a pre-release build, which the policy classifies as a regular issue Downstream applications that call Exiv2, including KDE components, digiKam and darktable, which have their own trackers Defects inside a third-party library Exiv2 links, unless Exiv2's own use of it is what makes them reachable Distribution patches and packaging rather than upstream Exiv2 Public GitHub issues used for an unfixed security defect, when the policy provides a private draft advisory instead Most-valued findings Memory corruption reachable from simply reading metadata out of a file, since that is what every photo manager does on import and what a server does before storing an upload The maker-note decoders. Each vendor format is a separate parser with a small user base and a fraction of the review the EXIF core gets, while being reachable from any JPEG Offset and count arithmetic in IFD traversal, where a declared length that overruns the buffer is the oldest bug in this format and keeps returning The BMFF path, which is the newest surface in the tree and applies the same trust to box sizes that HEIC and AVIF containers put entirely under attacker control The write path, where a rewrite driven by attacker-supplied structures corrupts adjacent data or lands bytes outside the intended region Anything that escalates from parsing to execution. The class anchor is the ExifTool CVE-2021-22204 shape, where a metadata field became code on the processing host Unbounded allocation or non-terminating parsing from a small file, because Exiv2 usually runs inside a batch import over thousands of images Reads that leak adjacent process memory into written metadata, since the resulting file often goes straight back to the person who uploaded it Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Open a draft security advisory on github.com/Exiv2/exiv2, which is what SECURITY.md asks for. The draft is private until the maintainers publish it and it is where the details get discussed Reproduce against a released version. The policy is explicit that a bug only reproducible on main or on a pre-release is a regular issue rather than a security issue Attach the file. Metadata bugs turn on byte-level structure and a description of the offending tag is not reproducible Name the entry point: the exiv2 command-line tool, a specific API call, or a downstream application that led you there Say which build options were on. BMFF support and the XMP toolkit are conditional, and a finding behind a disabled flag needs that stated up front Check the published advisory list before filing. Thirty are on record and a duplicate costs the maintainers triage time Disclosure Coordinated inside a GitHub draft security advisory, which stays private until the maintainers publish it, then released as a GitHub Security Advisory with a CVE alongside a patched version. The advisory history is linked from the policy itself, so the cadence is easy to read before you file. The policy sets out the mechanism without committing to a fixed embargo length, so settle the publication date in the draft thread rather than assuming a day count. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability