CVE-2025-54080
published 2025-08-29CVE-2025-54080: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in…
PriorityP420medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.13%
3.2th percentile
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | exiv2 | < exiv2 0.28.7+dfsg-2 (forky) | exiv2 0.28.7+dfsg-2 (forky) |
| exiv2 | exiv2 | < 0.28.6 | 0.28.6 |
| exiv2 | exiv2 | >= 0 < 0.28.7+dfsg-2 | 0.28.7+dfsg-2 |
| exiv2 | exiv2 | >= 0 < 0.27.5-3ubuntu1.1 | 0.27.5-3ubuntu1.1 |
| exiv2 | exiv2 | >= 0 < 0.27.5-3ubuntu1.3 | 0.27.5-3ubuntu1.3 |
| exiv2 | exiv2 | >= 0 < 0.27.6-1ubuntu0.1 | 0.27.6-1ubuntu0.1 |
| exiv2 | exiv2 | >= 0 < 0.27.6-1ubuntu0.3 | 0.27.6-1ubuntu0.3 |
| exiv2 | exiv2 | >= 0 < 0.28.5+dfsg-1ubuntu0.1 | 0.28.5+dfsg-1ubuntu0.1 |
| exiv2 | exiv2 | >= 0 < 0.28.5+dfsg-1ubuntu0.3 | 0.28.5+dfsg-1ubuntu0.3 |
| exiv2 | exiv2 | >= 0 < 0.25-2.1ubuntu16.04.7+esm5 | 0.25-2.1ubuntu16.04.7+esm5 |
| exiv2 | exiv2 | >= 0 < 0.25-3.1ubuntu0.18.04.11+esm1 | 0.25-3.1ubuntu0.18.04.11+esm1 |
| exiv2 | exiv2 | >= 0 < 0.27.2-8ubuntu2.7+esm1 | 0.27.2-8ubuntu2.7+esm1 |
| exiv2 | exiv2 | >= 0 < 0.27.2-8ubuntu2.7+esm3 | 0.27.2-8ubuntu2.7+esm3 |
| exiv2 | exiv2 | 0 – 0.17.3 | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv4.01.8LOWCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv8.1HIGH
vendor_ubuntu8.1HIGH
vendor_debian1.8LOW
vendor_redhat1.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Exiv2 regression
vendor_ubuntu·2026-03-19·CVSS 8.1
CVE-2025-55304 [HIGH] Exiv2 regression
Title: Exiv2 regression
Summary: USN-8103-1 introduced a regression in Exiv2
USN-8103-1 fixed vulnerabilities in Exiv2. The update caused a regression
for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and
Ubuntu 25.10. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Exiv2 did not correctly handle reading certain
buffers. An attacker could possibly use this issue to leak sensitive
information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04
LTS. (CVE-2020-18771)
Wen Cheng discovered that Exiv2 did not correctly handle certain memory
allocation. If a user or system were tricked into opening a specially
crafted file, an attacker could possibly use this issue to cause a denial
of service. This issue on
Ubuntu
Exiv2 vulnerabilities
vendor_ubuntu·2026-03-18·CVSS 8.1
CVE-2026-27631 [HIGH] Exiv2 vulnerabilities
Title: Exiv2 vulnerabilities
Summary: Several security issues were fixed in Exiv2.
It was discovered that Exiv2 did not correctly handle reading certain
buffers. An attacker could possibly use this issue to leak sensitive
information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04
LTS. (CVE-2020-18771)
Wen Cheng discovered that Exiv2 did not correctly handle certain memory
allocation. If a user or system were tricked into opening a specially
crafted file, an attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
(CVE-2020-18899)
It was discovered that Exiv2 did not correctly handle writing certain
metadata. If a user or system were tricked into opening a specially crafted
file, an attacker could p
Red Hat
exiv2: Exiv2 Segmentation Faults
vendor_redhat·2025-08-29·CVSS 1.8
CVE-2025-54080 [LOW] CWE-125 exiv2: Exiv2 Segmentation Faults
exiv2: Exiv2 Segmentation Faults
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.
A denial of service flaw has been discovered in the Exiv2 image tool. An out-of-bounds read was found which is triggere
Debian
CVE-2025-54080: exiv2 - Exiv2 is a C++ library and a command-line utility to read, write, delete and mod...
vendor_debian·2025·CVSS 1.8
CVE-2025-54080 [LOW] CVE-2025-54080: exiv2 - Exiv2 is a C++ library and a command-line utility to read, write, delete and mod...
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 0.28.7+dfsg-2)
sid: resolved (fixed in 0.28.7+dfsg-2)
trixie: open
OSV
exiv2 regression
osv·2026-03-19·CVSS 8.1
CVE-2020-18771 [HIGH] exiv2 regression
exiv2 regression
USN-8103-1 fixed vulnerabilities in Exiv2. The update caused a regression
for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and
Ubuntu 25.10. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Exiv2 did not correctly handle reading certain
buffers. An attacker could possibly use this issue to leak sensitive
information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04
LTS. (CVE-2020-18771)
Wen Cheng discovered that Exiv2 did not correctly handle certain memory
allocation. If a user or system were tricked into opening a specially
crafted file, an attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
(CVE-2020-
OSV
exiv2 vulnerabilities
osv·2026-03-18·CVSS 8.1
CVE-2020-18771 [HIGH] exiv2 vulnerabilities
exiv2 vulnerabilities
It was discovered that Exiv2 did not correctly handle reading certain
buffers. An attacker could possibly use this issue to leak sensitive
information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04
LTS. (CVE-2020-18771)
Wen Cheng discovered that Exiv2 did not correctly handle certain memory
allocation. If a user or system were tricked into opening a specially
crafted file, an attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
(CVE-2020-18899)
It was discovered that Exiv2 did not correctly handle writing certain
metadata. If a user or system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to cause a denial of
service. (CVE-2025
OSV
Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file
osv·2025-08-29
CVE-2025-54080 [LOW] Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file
Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file
### Impact
An out-of-bounds read was found in Exiv2 versions v0.28.5 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file.
Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extr
GHSA
Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file
ghsa·2025-08-29
CVE-2025-54080 [LOW] CWE-125 Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file
Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file
### Impact
An out-of-bounds read was found in Exiv2 versions v0.28.5 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file.
Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extr
OSV
CVE-2025-54080: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata
osv·2025-08-29·CVSS 1.8
CVE-2025-54080 [LOW] CVE-2025-54080: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-08-29
Published