CVE-2025-55304
Fixed in a distro release EPSS <1%CVSS 1.8
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.
Products: exiv2
Affected upstream, no fix yet
| Ecosystem | Package |
|---|---|
| PyPI | exiv2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | exiv2 | 0.27.0-4.amzn2.0.6 |
| Amazon Linux 2 | exiv2-devel | 0.27.0-4.amzn2.0.6 |
| Amazon Linux 2 | exiv2-doc | 0.27.0-4.amzn2.0.6 |
| Amazon Linux 2 | exiv2-libs | 0.27.0-4.amzn2.0.6 |
| Amazon Linux 2023 | exiv2 | 0.28.5-129.amzn2023 |
| Amazon Linux 2023 | exiv2-devel | 0.28.5-129.amzn2023 |
| Amazon Linux 2023 | exiv2-doc | 0.28.5-129.amzn2023 |
| Amazon Linux 2023 | exiv2-libs | 0.28.5-129.amzn2023 |
| Debian 12 | exiv2 | no fix |
| Debian 13 | exiv2 | no fix |
| Debian 14 | exiv2 | 0.28.7+dfsg-2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | exiv2-0_26 | 0.26-150400.9.27.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | exiv2-0_26 | 0.26-150400.9.27.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | exiv2-0_26 | 0.26-150400.9.27.1 |
| SUSE Linux Enterprise Server 16.0 | exiv2 | 0.28.8-160000.1.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | exiv2-0_26 | 0.26-150400.9.27.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | exiv2 | 0.28.8-160000.1.1 |
| Ubuntu 22.04 LTS | exiv2 | no fix |
| Ubuntu 22.04 LTS | exiv2 | 0.27.5-3ubuntu1.1 |
| Ubuntu 22.04 LTS | exiv2 | 0.27.5-3ubuntu1.3 |
| Ubuntu 24.04 LTS | exiv2 | 0.27.6-1ubuntu0.3 |
| Ubuntu 24.04 LTS | exiv2 | no fix |
| Ubuntu 24.04 LTS | exiv2 | 0.27.6-1ubuntu0.1 |
| Ubuntu 25.10 | exiv2 | 0.28.5+dfsg-1ubuntu0.1 |
| Ubuntu 25.10 | exiv2 | no fix |
| Ubuntu 25.10 | exiv2 | 0.28.5+dfsg-1ubuntu0.3 |
| Ubuntu Pro 16.04 LTS | exiv2 | 0.25-2.1ubuntu16.04.7+esm5 |
| Ubuntu Pro 18.04 LTS | exiv2 | 0.25-3.1ubuntu0.18.04.11+esm1 |
| Ubuntu Pro 20.04 LTS | exiv2 | 0.27.2-8ubuntu2.7+esm1 |
| Ubuntu Pro 20.04 LTS | exiv2 | no fix |
| Ubuntu Pro 20.04 LTS | exiv2 | 0.27.2-8ubuntu2.7+esm3 |
| openSUSE Leap 15.6 | exiv2-0_26 | 0.26-150400.9.27.1 |
| openSUSE Leap 16.0 | exiv2 | 0.28.8-160000.1.1 |
| openSUSE Tumbleweed | exiv2 | 0.28.8-1.1 |