In Exiv2 0.26 and previous versions, PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (application crash due to a heap-based buffer over-read) via a crafted PNG file.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-19535.json"