CVE-2025-55304
published 2025-08-29CVE-2025-55304: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in…
PriorityP420medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.23%
13.3th percentile
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | exiv2 | < exiv2 0.28.7+dfsg-2 (forky) | exiv2 0.28.7+dfsg-2 (forky) |
| exiv2 | exiv2 | < 0.28.6 | 0.28.6 |
| exiv2 | exiv2 | >= 0 < 0.28.7+dfsg-2 | 0.28.7+dfsg-2 |
| exiv2 | exiv2 | >= 0 < 0.27.5-3ubuntu1.1 | 0.27.5-3ubuntu1.1 |
| exiv2 | exiv2 | >= 0 < 0.27.5-3ubuntu1.3 | 0.27.5-3ubuntu1.3 |
| exiv2 | exiv2 | >= 0 < 0.27.6-1ubuntu0.1 | 0.27.6-1ubuntu0.1 |
| exiv2 | exiv2 | >= 0 < 0.27.6-1ubuntu0.3 | 0.27.6-1ubuntu0.3 |
| exiv2 | exiv2 | >= 0 < 0.28.5+dfsg-1ubuntu0.1 | 0.28.5+dfsg-1ubuntu0.1 |
| exiv2 | exiv2 | >= 0 < 0.28.5+dfsg-1ubuntu0.3 | 0.28.5+dfsg-1ubuntu0.3 |
| exiv2 | exiv2 | >= 0 < 0.25-2.1ubuntu16.04.7+esm5 | 0.25-2.1ubuntu16.04.7+esm5 |
| exiv2 | exiv2 | >= 0 < 0.25-3.1ubuntu0.18.04.11+esm1 | 0.25-3.1ubuntu0.18.04.11+esm1 |
| exiv2 | exiv2 | >= 0 < 0.27.2-8ubuntu2.7+esm1 | 0.27.2-8ubuntu2.7+esm1 |
| exiv2 | exiv2 | >= 0 < 0.27.2-8ubuntu2.7+esm3 | 0.27.2-8ubuntu2.7+esm3 |
| exiv2 | exiv2 | 0 – 0.17.3 | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv4.01.8LOWCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv8.1HIGH
vendor_ubuntu8.1HIGH
vendor_debian1.8LOW
vendor_redhat1.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Exiv2 regression
vendor_ubuntu·2026-03-19·CVSS 8.1
CVE-2025-55304 [HIGH] Exiv2 regression
Title: Exiv2 regression
Summary: USN-8103-1 introduced a regression in Exiv2
USN-8103-1 fixed vulnerabilities in Exiv2. The update caused a regression
for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and
Ubuntu 25.10. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Exiv2 did not correctly handle reading certain
buffers. An attacker could possibly use this issue to leak sensitive
information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04
LTS. (CVE-2020-18771)
Wen Cheng discovered that Exiv2 did not correctly handle certain memory
allocation. If a user or system were tricked into opening a specially
crafted file, an attacker could possibly use this issue to cause a denial
of service. This issue on
Ubuntu
Exiv2 vulnerabilities
vendor_ubuntu·2026-03-18·CVSS 8.1
CVE-2026-27631 [HIGH] Exiv2 vulnerabilities
Title: Exiv2 vulnerabilities
Summary: Several security issues were fixed in Exiv2.
It was discovered that Exiv2 did not correctly handle reading certain
buffers. An attacker could possibly use this issue to leak sensitive
information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04
LTS. (CVE-2020-18771)
Wen Cheng discovered that Exiv2 did not correctly handle certain memory
allocation. If a user or system were tricked into opening a specially
crafted file, an attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
(CVE-2020-18899)
It was discovered that Exiv2 did not correctly handle writing certain
metadata. If a user or system were tricked into opening a specially crafted
file, an attacker could p
Red Hat
exiv2: Exiv2 has quadratic performance in ICC profile parsing
vendor_redhat·2025-08-29·CVSS 1.8
CVE-2025-55304 [LOW] CWE-407 exiv2: Exiv2 has quadratic performance in ICC profile parsing
exiv2: Exiv2 has quadratic performance in ICC profile parsing
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.
A denial of service flaw was found in exiv2. A quadratic algorithm in the ICC profile parsing code in the jpegBase::readMetadata() function can cause Exiv2 to run for a long time. When Exiv2 is used to read the metadata of a crafted jpg image file, it triggers a denial of service.
Statement: H
Debian
CVE-2025-55304: exiv2 - Exiv2 is a C++ library and a command-line utility to read, write, delete and mod...
vendor_debian·2025·CVSS 1.8
CVE-2025-55304 [LOW] CVE-2025-55304: exiv2 - Exiv2 is a C++ library and a command-line utility to read, write, delete and mod...
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 0.28.7+dfsg-2)
sid: resolved (fixed in 0.28.7+dfsg-2)
trixie: open
OSV
exiv2 regression
osv·2026-03-19·CVSS 8.1
CVE-2020-18771 [HIGH] exiv2 regression
exiv2 regression
USN-8103-1 fixed vulnerabilities in Exiv2. The update caused a regression
for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and
Ubuntu 25.10. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Exiv2 did not correctly handle reading certain
buffers. An attacker could possibly use this issue to leak sensitive
information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04
LTS. (CVE-2020-18771)
Wen Cheng discovered that Exiv2 did not correctly handle certain memory
allocation. If a user or system were tricked into opening a specially
crafted file, an attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
(CVE-2020-
OSV
exiv2 vulnerabilities
osv·2026-03-18·CVSS 8.1
CVE-2020-18771 [HIGH] exiv2 vulnerabilities
exiv2 vulnerabilities
It was discovered that Exiv2 did not correctly handle reading certain
buffers. An attacker could possibly use this issue to leak sensitive
information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04
LTS. (CVE-2020-18771)
Wen Cheng discovered that Exiv2 did not correctly handle certain memory
allocation. If a user or system were tricked into opening a specially
crafted file, an attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
(CVE-2020-18899)
It was discovered that Exiv2 did not correctly handle writing certain
metadata. If a user or system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to cause a denial of
service. (CVE-2025
OSV
Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata
osv·2025-08-29
CVE-2025-55304 [LOW] Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata
Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata
### Impact
A denial-of-service was found in Exiv2 version v0.28.5: a quadratic algorithm in the ICC profile parsing code in `jpegBase::readMetadata()` can cause Exiv2 to run for a long time. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file.
### Patches
The bug is fixed in version v0.28.6.
### References
Issue: https://github.com/Exiv2/exiv2/issues/3333
Fixes: https://github.com/Exiv2/exiv2/pull/3335 (main branch), https://github.com/Exiv2/exiv2/pull/3345 (0.28.x branch)
### For more information
Please see our [security policy](https
OSV
CVE-2025-55304: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata
osv·2025-08-29·CVSS 1.8
CVE-2025-55304 [LOW] CVE-2025-55304: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.
GHSA
Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata
ghsa·2025-08-29
CVE-2025-55304 [LOW] CWE-407 Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata
Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata
### Impact
A denial-of-service was found in Exiv2 version v0.28.5: a quadratic algorithm in the ICC profile parsing code in `jpegBase::readMetadata()` can cause Exiv2 to run for a long time. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file.
### Patches
The bug is fixed in version v0.28.6.
### References
Issue: https://github.com/Exiv2/exiv2/issues/3333
Fixes: https://github.com/Exiv2/exiv2/pull/3335 (main branch), https://github.com/Exiv2/exiv2/pull/3345 (0.28.x branch)
### For more information
Please see our [security policy](https
No detection rules found.
No public exploits indexed.
2025-08-29
Published