CVE-2025-55304

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.

Impact

A denial-of-service was found in Exiv2 version v0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file.

Patches

The bug is fixed in version v0.28.6.

References

Issue: https://github.com/Exiv2/exiv2/issues/3333 Fixes: https://github.com/Exiv2/exiv2/pull/3335 (main branch), https://github.com/Exiv2/exiv2/pull/3345 (0.28.x branch)

For more information

Please see our security policy for information about Exiv2 security.

Impact

A denial-of-service was found in Exiv2 version v0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file.

Patches

The bug is fixed in version v0.28.6.

References

Issue: https://github.com/Exiv2/exiv2/issues/3333 Fixes: https://github.com/Exiv2/exiv2/pull/3335 (main branch), https://github.com/Exiv2/exiv2/pull/3345 (0.28.x branch)

For more information

Please see our security policy for information about Exiv2 security.

Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.

Security Fix(es):

A vulnerability, which was classified as problematic, was found in exiv2 up to 0.28.5 (Image Processing Software).CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying the patch e737332427711f15bcdc4e903203d6b7493eaec0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54080)

A vulnerability was found in exiv2 up to 0.28.5 (Image Processing Software). It has been classified as problematic.CWE is classifying the issue as CWE-407. An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55304)

Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.

Security Fix(es):

A vulnerability, which was classified as problematic, was found in exiv2 up to 0.28.5 (Image Processing Software).CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying the patch e737332427711f15bcdc4e903203d6b7493eaec0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54080)

A vulnerability was found in exiv2 up to 0.28.5 (Image Processing Software). It has been classified as problematic.CWE is classifying the issue as CWE-407. An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55304)

Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.

Security Fix(es):

A vulnerability, which was classified as problematic, was found in exiv2 up to 0.28.5 (Image Processing Software).CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying the patch e737332427711f15bcdc4e903203d6b7493eaec0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54080)

A vulnerability was found in exiv2 up to 0.28.5 (Image Processing Software). It has been classified as problematic.CWE is classifying the issue as CWE-407. An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55304)

Impact

A denial-of-service was found in Exiv2 version v0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file.

Patches

The bug is fixed in version v0.28.6.

References

Issue: https://github.com/Exiv2/exiv2/issues/3333 Fixes: https://github.com/Exiv2/exiv2/pull/3335 (main branch), https://github.com/Exiv2/exiv2/pull/3345 (0.28.x branch)

For more information

Please see our security policy for information about Exiv2 security.

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.

• CVE-2025-55304: add new method appendIccProfile to fix quadratic performance issue

• CVE-2025-55304: add new method appendIccProfile to fix quadratic performance issue

These are all security issues fixed in the exiv2-0.28.8-1.1 package on the GA media of openSUSE Tumbleweed.

This update for exiv2 fixes the following issues:

Update to exiv2 0.28.8:

• CVE-2024-24826: out-of-bounds read in QuickTimeVideo: NikonTagsDecoder (bsc#1219870).
• CVE-2024-25112: denial of service due to unbounded recursion in QuickTimeVideo: multipleEntriesDecoder (bsc#1219871).
• CVE-2024-39695: out-of-bounds read in AsfVideo: streamProperties (bsc#1227528).
• CVE-2025-26623: heap buffer overflow via writing metadata into a crafted image file (bsc#1237347).
• CVE-2025-54080: out-of-bounds read in Exiv2: EpsImage: writeMetadata() when writing metadata into a crafted image file (bsc#1248962).
• CVE-2025-55304: quadratic performance algorithm in the ICC profile parsing code of JpegBase: readMetadata (bsc#1248963).
• CVE-2026-25884: out-of-bounds read in CrwMap: decode0x0805 (bsc#1259083).
• CVE-2026-27596: integer overflow in LoaderNative: getData() leads to out-of-bounds read (bsc#1259084).
• CVE-2026-27631: crash due to uncaught exception when trying to create std: vector larger than max_size() (bsc#1259085).

This update for exiv2-0_26 fixes the following issues:

Add reference for previously fixed issue:

• CVE-2025-55304: Fixed quadratic performance algorithm in the ICC profile parsing code of JpegBase::readMetadata (bsc#1248963).

This update for exiv2 fixes the following issues:

Update to exiv2 0.28.8:

• CVE-2024-24826: out-of-bounds read in QuickTimeVideo: NikonTagsDecoder (bsc#1219870).
• CVE-2024-25112: denial of service due to unbounded recursion in QuickTimeVideo: multipleEntriesDecoder (bsc#1219871).
• CVE-2024-39695: out-of-bounds read in AsfVideo: streamProperties (bsc#1227528).
• CVE-2025-26623: heap buffer overflow via writing metadata into a crafted image file (bsc#1237347).
• CVE-2025-54080: out-of-bounds read in Exiv2: EpsImage: writeMetadata() when writing metadata into a crafted image file (bsc#1248962).
• CVE-2025-55304: quadratic performance algorithm in the ICC profile parsing code of JpegBase: readMetadata (bsc#1248963).
• CVE-2026-25884: out-of-bounds read in CrwMap: decode0x0805 (bsc#1259083).
• CVE-2026-27596: integer overflow in LoaderNative: getData() leads to out-of-bounds read (bsc#1259084).
• CVE-2026-27631: crash due to uncaught exception when trying to create std: vector larger than max_size() (bsc#1259085).

USN-8103-1 fixed vulnerabilities in Exiv2. The update caused a regression for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that Exiv2 did not correctly handle reading certain buffers. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-18771)

Wen Cheng discovered that Exiv2 did not correctly handle certain memory allocation. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-18899)

It was discovered that Exiv2 did not correctly handle writing certain metadata. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. (CVE-2025-54080)

It was discovered that Exiv2 did not correctly handle parsing certain metadata. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-55304)

It was discovered that Exiv2 did not correctly handle parsing certain images. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. (CVE-2026-25884)

It was discovered that Exiv2 did not correctly handle previewing certain images. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-27596)

It was discovered that Exiv2 did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-27631)