An Invalid memory address dereference was discovered in Exiv2::getULong in types.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
https://usn.ubuntu.com/3852-1/
https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html