{"id":"CVE-2025-54080","aliases":["ALPINE-CVE-2025-54080","AZL-66711","AZL-66764","CLSA-2025-1766499581","CLSA-2025-1766500438","DEBIAN-CVE-2025-54080","EUVD-2025-26207","GHSA-496f-x7cq-cq39","JLSEC-2026-1314","OESA-2025-2113","OESA-2025-2114","OESA-2025-2115","OESA-2025-2116","OESA-2025-2117","OESA-2025-2274","PYSEC-2026-1354","SUSE-SU-2026:20923-1","SUSE-SU-2026:2663-1","UBUNTU-CVE-2025-54080","openSUSE-SU-2026:10298-1","openSUSE-SU-2026:20410-1"],"status":"published","title":"Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.","severity":{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00143,"percentile":0.03627,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2025-08-29T14:49:41Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"exiv2","fixed_in":["0.28.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"exiv2","fixed_in":["0.28.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"exiv2","fixed_in":["0.28.6-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"exiv2","fixed_in":["0.27.5-2.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"exiv2-devel","fixed_in":["0.27.5-2.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"exiv2-doc","fixed_in":["0.27.5-2.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"exiv2-libs","fixed_in":["0.27.5-2.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"exiv2","fixed_in":["0.27.5-2.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"exiv2-devel","fixed_in":["0.27.5-2.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"exiv2-doc","fixed_in":["0.27.5-2.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"exiv2-libs","fixed_in":["0.27.5-2.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"exiv2","fixed_in":["0.28.7+dfsg-2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"exiv2","fixed_in":["0.27.5-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"exiv2","fixed_in":["0.27.5-4.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"exiv2","fixed_in":["0.27.5-4.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exiv2","fixed_in":["0.25-2.1ubuntu16.04.7+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exiv2","fixed_in":["0.25-3.1ubuntu0.18.04.11+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exiv2","fixed_in":["0.27.2-8ubuntu2.7+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"exiv2","fixed_in":["0.27.5-3ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"exiv2","fixed_in":["0.27.6-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"exiv2","fixed_in":["0.28.5+dfsg-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.17.3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.6-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.28.3-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.28.0-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-2.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exiv2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-2.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exiv2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-2.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exiv2-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-2.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-2.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exiv2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-2.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exiv2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-2.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exiv2-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-2.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.27.6-1","0.28.0+dfsg-1","0.28.0+dfsg-2","0.28.0+dfsg-3","0.28.0+dfsg-4","0.28.1+dfsg-1","0.28.1+dfsg-2","0.28.1+dfsg-3","0.28.2+dfsg-1","0.28.3+dfsg-1","0.28.3+dfsg-2","0.28.4+dfsg-1","0.28.4+dfsg-2","0.28.5+dfsg-1","0.28.7+dfsg-1","0.28.7+dfsg-2","0.28.8+dfsg-1","0.28.9+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28.5+dfsg-1","0.28.7+dfsg-1","0.28.7+dfsg-2","0.28.8+dfsg-1","0.28.9+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.7+dfsg-2"}]}],"versions":["0.28.5+dfsg-1","0.28.7+dfsg-1"]},{"source":"osv","ecosystem":"PyPI","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.17.3"}]}],"versions":["0.1","0.11.0","0.11.1","0.11.2","0.11.3","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.14.0","0.14.1","0.15.0","0.16.0","0.16.1","0.16.2","0.16.2.post1","0.16.3","0.16.3.post1","0.17.0","0.17.1","0.17.2","0.17.3","0.2","0.3","0.3.1"]},{"source":"osv","ecosystem":"Julia","package":"Exiv2_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-4.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-4.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.2-4.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.2-4.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.2-4.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.17.3"}]}],"versions":["0.1","0.11.0","0.11.1","0.11.2","0.11.3","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.14.0","0.14.1","0.15.0","0.16.0","0.16.1","0.16.2","0.16.2.post1","0.16.3","0.16.3.post1","0.17.0","0.17.1","0.17.2","0.17.3","0.2","0.3","0.3.1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.8-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.8-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23-12.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-2.1ubuntu16.04.7+esm5"}]}],"versions":["0.25-1ubuntu1","0.25-2.1","0.25-2.1ubuntu16.04.1","0.25-2.1ubuntu16.04.2","0.25-2.1ubuntu16.04.3","0.25-2.1ubuntu16.04.4","0.25-2.1ubuntu16.04.5","0.25-2.1ubuntu16.04.6","0.25-2.1ubuntu16.04.7+esm1","0.25-2.1ubuntu16.04.7+esm2","0.25-2.1ubuntu16.04.7+esm3","0.25-2.1ubuntu16.04.7+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-3.1ubuntu0.18.04.11+esm1"}]}],"versions":["0.25-3.1","0.25-3.1ubuntu0.18.04.1","0.25-3.1ubuntu0.18.04.2","0.25-3.1ubuntu0.18.04.3","0.25-3.1ubuntu0.18.04.4","0.25-3.1ubuntu0.18.04.5","0.25-3.1ubuntu0.18.04.7","0.25-3.1ubuntu0.18.04.9","0.25-3.1ubuntu0.18.04.10","0.25-3.1ubuntu0.18.04.11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-8ubuntu2.7+esm1"}]}],"versions":["0.25-4ubuntu2","0.25-4ubuntu3","0.27.2-8ubuntu2","0.27.2-8ubuntu2.2","0.27.2-8ubuntu2.4","0.27.2-8ubuntu2.5","0.27.2-8ubuntu2.6","0.27.2-8ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-3ubuntu1.1"}]}],"versions":["0.27.3-3ubuntu4","0.27.3-3.1ubuntu1","0.27.5-1ubuntu1","0.27.5-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.6-1ubuntu0.1"}]}],"versions":["0.27.6-1","0.27.6-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.5+dfsg-1ubuntu0.1"}]}],"versions":["0.28.5+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.8-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.8-160000.1.1"}]}],"bundled":9}],"products":[{"vendor":"exiv2","product":"exiv2"}],"references":[{"url":"https://github.com/Exiv2/exiv2/security/advisories/GHSA-496f-x7cq-cq39","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/Exiv2/exiv2/commit/e737332427711f15bcdc4e903203d6b7493eaec0","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54080","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-496f-x7cq-cq39","tags":["web","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-54080","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1766499581.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2025-1766500438.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54080.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-54080","tags":["advisory"]},{"url":"https://github.com/Exiv2/exiv2","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2113","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2114","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2115","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55304","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2117","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2274","tags":["advisory"]},{"url":"https://pypi.org/project/exiv2","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620923-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219870","tags":["report"]},{"url":"https://bugzilla.suse.com/1219871","tags":["report"]},{"url":"https://bugzilla.suse.com/1227528","tags":["report"]},{"url":"https://bugzilla.suse.com/1237347","tags":["report"]},{"url":"https://bugzilla.suse.com/1248962","tags":["report"]},{"url":"https://bugzilla.suse.com/1248963","tags":["report"]},{"url":"https://bugzilla.suse.com/1259083","tags":["report"]},{"url":"https://bugzilla.suse.com/1259084","tags":["report"]},{"url":"https://bugzilla.suse.com/1259085","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-26623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27631","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262663-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-54080","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-54080","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8103-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-54080","title":"Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.","status":"published","published":"2025-08-29T14:50:17.623Z","modified":"2025-08-29T14:58:23.574Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:32:27.28543Z"}],"euvd":[{"id":"EUVD-2025-26207","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.","status":"published","published":"2025-08-29T14:50:17Z","modified":"2025-08-29T14:58:23Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T20:31:49.600955Z"}],"ghsa":[{"id":"GHSA-496f-x7cq-cq39","title":"Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file","description":"### Impact\nAn out-of-bounds read was found in Exiv2 versions v0.28.5 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file.\n\nNote that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as delete.\n\n### Patches\nThe bug is fixed in version v0.28.6.\n\n### Credit\nThank you to @dragonArthurX for reporting this issue.\n\n### Details (from original report by @dragonArthurX )\n**Version:**\nTested on v0.28.5 (latest official release)\nCommit: 907169fa643c2c74c14fd4106e55eaeee3634d9f\n\n**Platform:**\nUbuntu 20.04.6 LTS (x86_64)\n\n**Build Steps:**\n```bash\ngit clone https://github.com/Exiv2/exiv2.git\ncd exiv2\ngit checkout v0.28.5\nmkdir build-v0.28.5 \u0026\u0026 cd build-v0.28.5\ncmake -DCMAKE_C_COMPILER=/fuzzer/afl-clang-fast -DCMAKE_CXX_COMPILER=/fuzzer/afl-clang-fast++ -DCMAKE_C_FLAGS=\"-g -fsanitize=address\" -DCMAKE_CXX_FLAGS=\"-g -fsanitize=address\" -DBUILD_SHARED_LIBS=OFF ../\n```\n\n**Command line to reproduce:**\n```bash\n/home/exiv2/build/bin/exiv2 -d a -f /home/poc \n```\n\n**Crash Output:** \n```\nAddressSanitizer:DEADLYSIGNAL\n ================================================================ = \n==376531==ERROR: AddressSanitizer: SEGV on unknown address 0x7fd92236b0e7 (pc 0x7fd82314dcd2 bp 0x7ffd540ceba0 sp 0x7ffd540ce358 T0)\n==376531==The signal is caused by a READ memory access.\n    #0 0x7fd82314dcd2  /build/glibc-B3wQXB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:383\n    #1 0x4ed131 in __asan_memcpy (/home/exiv2/build-v0.28.5/bin/exiv2+0x4ed131)\n    #2 0x6184b1 in Exiv2::MemIo::write(unsigned char const*, unsigned long) /home/exiv2/src/basicio.cpp:704:5\n    #3 0xad336d in (anonymous namespace)::writeTemp(Exiv2::BasicIo\u0026, unsigned char const*, unsigned long) /home/exiv2/src/epsimage.cpp:90:14\n    #4 0xac3a07 in (anonymous namespace)::readWriteEpsMetadata(Exiv2::BasicIo\u0026, std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e\u0026, std::vector\u003cExiv2::NativePreview, std::allocator\u003cExiv2::NativePreview\u003e \u003e\u0026, bool) /home/exiv2/src/epsimage.cpp:1009:7\n    #5 0xad1175 in Exiv2::EpsImage::writeMetadata() /home/exiv2/src/epsimage.cpp:1103:3\n    #6 0x5d2383 in Action::Erase::run(std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e const\u0026) /home/exiv2/app/actions.cpp:713:14\n    #7 0x522d02 in main /home/exiv2/app/exiv2.cpp:177:25\n    #8 0x7fd8230b6082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #9 0x4714dd in _start (/home/exiv2/build-v0.28.5/bin/exiv2+0x4714dd)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV /build/glibc-B3wQXB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:383 \n==376531==ABORTING\n```","status":"published","published":"2025-08-29T14:49:41Z","modified":"2025-08-29T21:03:54Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:38:55.953734Z"}],"nvd":[{"id":"CVE-2025-54080","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.","status":"published","published":"2025-08-29T15:15:35.613Z","modified":"2026-10-19T17:10:00.173Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:11:26.200344Z"}],"osv":[{"id":"ALPINE-CVE-2025-54080","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.","status":"published","published":"2025-08-29T15:15:35.613Z","modified":"2026-11-03T06:32:52.021035423Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"CVE-2025-54080","title":"Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.","status":"published","published":"2025-08-29T14:50:17.623Z","modified":"2026-10-28T02:30:45.158942392Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:50.863921Z"},{"id":"DEBIAN-CVE-2025-54080","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.","status":"published","published":"2025-08-29T15:15:35.613Z","modified":"2026-10-23T17:47:43.382999996Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-496f-x7cq-cq39","title":"Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file","description":"### Impact\nAn out-of-bounds read was found in Exiv2 versions v0.28.5 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file.\n\nNote that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as delete.\n\n### Patches\nThe bug is fixed in version v0.28.6.\n\n### Credit\nThank you to @dragonArthurX for reporting this issue.\n\n### Details (from original report by @dragonArthurX )\n**Version:**\nTested on v0.28.5 (latest official release)\nCommit: 907169fa643c2c74c14fd4106e55eaeee3634d9f\n\n**Platform:**\nUbuntu 20.04.6 LTS (x86_64)\n\n**Build Steps:**\n```bash\ngit clone https://github.com/Exiv2/exiv2.git\ncd exiv2\ngit checkout v0.28.5\nmkdir build-v0.28.5 \u0026\u0026 cd build-v0.28.5\ncmake -DCMAKE_C_COMPILER=/fuzzer/afl-clang-fast -DCMAKE_CXX_COMPILER=/fuzzer/afl-clang-fast++ -DCMAKE_C_FLAGS=\"-g -fsanitize=address\" -DCMAKE_CXX_FLAGS=\"-g -fsanitize=address\" -DBUILD_SHARED_LIBS=OFF ../\n```\n\n**Command line to reproduce:**\n```bash\n/home/exiv2/build/bin/exiv2 -d a -f /home/poc \n```\n\n**Crash Output:** \n```\nAddressSanitizer:DEADLYSIGNAL\n ================================================================ = \n==376531==ERROR: AddressSanitizer: SEGV on unknown address 0x7fd92236b0e7 (pc 0x7fd82314dcd2 bp 0x7ffd540ceba0 sp 0x7ffd540ce358 T0)\n==376531==The signal is caused by a READ memory access.\n    #0 0x7fd82314dcd2  /build/glibc-B3wQXB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:383\n    #1 0x4ed131 in __asan_memcpy (/home/exiv2/build-v0.28.5/bin/exiv2+0x4ed131)\n    #2 0x6184b1 in Exiv2::MemIo::write(unsigned char const*, unsigned long) /home/exiv2/src/basicio.cpp:704:5\n    #3 0xad336d in (anonymous namespace)::writeTemp(Exiv2::BasicIo\u0026, unsigned char const*, unsigned long) /home/exiv2/src/epsimage.cpp:90:14\n    #4 0xac3a07 in (anonymous namespace)::readWriteEpsMetadata(Exiv2::BasicIo\u0026, std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e\u0026, std::vector\u003cExiv2::NativePreview, std::allocator\u003cExiv2::NativePreview\u003e \u003e\u0026, bool) /home/exiv2/src/epsimage.cpp:1009:7\n    #5 0xad1175 in Exiv2::EpsImage::writeMetadata() /home/exiv2/src/epsimage.cpp:1103:3\n    #6 0x5d2383 in Action::Erase::run(std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e const\u0026) /home/exiv2/app/actions.cpp:713:14\n    #7 0x522d02 in main /home/exiv2/app/exiv2.cpp:177:25\n    #8 0x7fd8230b6082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #9 0x4714dd in _start (/home/exiv2/build-v0.28.5/bin/exiv2+0x4714dd)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV /build/glibc-B3wQXB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:383 \n==376531==ABORTING\n```","status":"published","published":"2025-08-29T14:49:41Z","modified":"2026-07-07T17:57:02.5538079Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"JLSEC-2026-1314","title":"Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file","description":"### Impact\n\nAn out-of-bounds read was found in Exiv2 versions v0.28.5 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file.\n\nNote that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as delete.\n\n### Patches\n\nThe bug is fixed in version v0.28.6.\n\n### Credit\n\nThank you to @dragonArthurX for reporting this issue.\n\n### Details (from original report by @dragonArthurX )\n\n**Version:**\nTested on v0.28.5 (latest official release)\nCommit: 907169fa643c2c74c14fd4106e55eaeee3634d9f\n\n**Platform:**\nUbuntu 20.04.6 LTS (x86_64)\n\n**Build Steps:**\n\n```bash\ngit clone https://github.com/Exiv2/exiv2.git\ncd exiv2\ngit checkout v0.28.5\nmkdir build-v0.28.5 \u0026\u0026 cd build-v0.28.5\ncmake -DCMAKE_C_COMPILER=/fuzzer/afl-clang-fast -DCMAKE_CXX_COMPILER=/fuzzer/afl-clang-fast++ -DCMAKE_C_FLAGS=\"-g -fsanitize=address\" -DCMAKE_CXX_FLAGS=\"-g -fsanitize=address\" -DBUILD_SHARED_LIBS=OFF ../\n```\n\n**Command line to reproduce:**\n\n```bash\n/home/exiv2/build/bin/exiv2 -d a -f /home/poc \n```\n\n**Crash Output:**\n\n```\nAddressSanitizer:DEADLYSIGNAL\n ================================================================ = \n==376531==ERROR: AddressSanitizer: SEGV on unknown address 0x7fd92236b0e7 (pc 0x7fd82314dcd2 bp 0x7ffd540ceba0 sp 0x7ffd540ce358 T0)\n==376531==The signal is caused by a READ memory access.\n    #0 0x7fd82314dcd2  /build/glibc-B3wQXB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:383\n    #1 0x4ed131 in __asan_memcpy (/home/exiv2/build-v0.28.5/bin/exiv2+0x4ed131)\n    #2 0x6184b1 in Exiv2::MemIo::write(unsigned char const*, unsigned long) /home/exiv2/src/basicio.cpp:704:5\n    #3 0xad336d in (anonymous namespace)::writeTemp(Exiv2::BasicIo\u0026, unsigned char const*, unsigned long) /home/exiv2/src/epsimage.cpp:90:14\n    #4 0xac3a07 in (anonymous namespace)::readWriteEpsMetadata(Exiv2::BasicIo\u0026, std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e\u0026, std::vector\u003cExiv2::NativePreview, std::allocator\u003cExiv2::NativePreview\u003e \u003e\u0026, bool) /home/exiv2/src/epsimage.cpp:1009:7\n    #5 0xad1175 in Exiv2::EpsImage::writeMetadata() /home/exiv2/src/epsimage.cpp:1103:3\n    #6 0x5d2383 in Action::Erase::run(std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e const\u0026) /home/exiv2/app/actions.cpp:713:14\n    #7 0x522d02 in main /home/exiv2/app/exiv2.cpp:177:25\n    #8 0x7fd8230b6082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #9 0x4714dd in _start (/home/exiv2/build-v0.28.5/bin/exiv2+0x4714dd)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV /build/glibc-B3wQXB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:383 \n==376531==ABORTING\n```","status":"published","published":"2026-08-13T15:55:58.236Z","modified":"2026-08-13T16:13:49.224600276Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2025-2113","title":"exiv2 security update","description":"Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as problematic, was found in exiv2 up to 0.28.5 (Image Processing Software).CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying the patch e737332427711f15bcdc4e903203d6b7493eaec0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54080)","status":"published","published":"2025-09-05T11:09:12Z","modified":"2026-08-18T01:18:08.722468655Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2114","title":"exiv2 security update","description":"Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as problematic, was found in exiv2 up to 0.28.5 (Image Processing Software).CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying the patch e737332427711f15bcdc4e903203d6b7493eaec0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54080)","status":"published","published":"2025-09-05T11:09:12Z","modified":"2026-08-18T01:18:58.209478949Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2115","title":"exiv2 security update","description":"Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as problematic, was found in exiv2 up to 0.28.5 (Image Processing Software).CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying the patch e737332427711f15bcdc4e903203d6b7493eaec0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54080)","status":"published","published":"2025-09-05T11:09:12Z","modified":"2026-08-18T01:18:09.073667261Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2116","title":"exiv2 security update","description":"Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as problematic, was found in exiv2 up to 0.28.5 (Image Processing Software).CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying the patch e737332427711f15bcdc4e903203d6b7493eaec0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54080)\n\nA vulnerability was found in exiv2 up to 0.28.5 (Image Processing Software). It has been classified as problematic.CWE is classifying the issue as CWE-407. An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55304)","status":"published","published":"2025-09-05T11:09:12Z","modified":"2026-08-18T01:18:09.078011394Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2117","title":"exiv2 security update","description":"Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as problematic, was found in exiv2 up to 0.28.5 (Image Processing Software).CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying the patch e737332427711f15bcdc4e903203d6b7493eaec0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54080)\n\nA vulnerability was found in exiv2 up to 0.28.5 (Image Processing Software). It has been classified as problematic.CWE is classifying the issue as CWE-407. An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55304)","status":"published","published":"2025-09-05T11:09:12Z","modified":"2026-08-18T01:18:09.09602503Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2274","title":"exiv2 security update","description":"Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as problematic, was found in exiv2 up to 0.28.5 (Image Processing Software).CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying the patch e737332427711f15bcdc4e903203d6b7493eaec0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54080)\n\nA vulnerability was found in exiv2 up to 0.28.5 (Image Processing Software). It has been classified as problematic.CWE is classifying the issue as CWE-407. An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55304)","status":"published","published":"2025-09-12T11:09:20Z","modified":"2026-08-18T01:19:10.172204904Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"PYSEC-2026-1354","title":"Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file","description":"### Impact\nAn out-of-bounds read was found in Exiv2 versions v0.28.5 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file.\n\nNote that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as delete.\n\n### Patches\nThe bug is fixed in version v0.28.6.\n\n### Credit\nThank you to @dragonArthurX for reporting this issue.\n\n### Details (from original report by @dragonArthurX )\n**Version:**\nTested on v0.28.5 (latest official release)\nCommit: 907169fa643c2c74c14fd4106e55eaeee3634d9f\n\n**Platform:**\nUbuntu 20.04.6 LTS (x86_64)\n\n**Build Steps:**\n```bash\ngit clone https://github.com/Exiv2/exiv2.git\ncd exiv2\ngit checkout v0.28.5\nmkdir build-v0.28.5 \u0026\u0026 cd build-v0.28.5\ncmake -DCMAKE_C_COMPILER=/fuzzer/afl-clang-fast -DCMAKE_CXX_COMPILER=/fuzzer/afl-clang-fast++ -DCMAKE_C_FLAGS=\"-g -fsanitize=address\" -DCMAKE_CXX_FLAGS=\"-g -fsanitize=address\" -DBUILD_SHARED_LIBS=OFF ../\n```\n\n**Command line to reproduce:**\n```bash\n/home/exiv2/build/bin/exiv2 -d a -f /home/poc \n```\n\n**Crash Output:** \n```\nAddressSanitizer:DEADLYSIGNAL\n ================================================================ = \n==376531==ERROR: AddressSanitizer: SEGV on unknown address 0x7fd92236b0e7 (pc 0x7fd82314dcd2 bp 0x7ffd540ceba0 sp 0x7ffd540ce358 T0)\n==376531==The signal is caused by a READ memory access.\n    #0 0x7fd82314dcd2  /build/glibc-B3wQXB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:383\n    #1 0x4ed131 in __asan_memcpy (/home/exiv2/build-v0.28.5/bin/exiv2+0x4ed131)\n    #2 0x6184b1 in Exiv2::MemIo::write(unsigned char const*, unsigned long) /home/exiv2/src/basicio.cpp:704:5\n    #3 0xad336d in (anonymous namespace)::writeTemp(Exiv2::BasicIo\u0026, unsigned char const*, unsigned long) /home/exiv2/src/epsimage.cpp:90:14\n    #4 0xac3a07 in (anonymous namespace)::readWriteEpsMetadata(Exiv2::BasicIo\u0026, std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e\u0026, std::vector\u003cExiv2::NativePreview, std::allocator\u003cExiv2::NativePreview\u003e \u003e\u0026, bool) /home/exiv2/src/epsimage.cpp:1009:7\n    #5 0xad1175 in Exiv2::EpsImage::writeMetadata() /home/exiv2/src/epsimage.cpp:1103:3\n    #6 0x5d2383 in Action::Erase::run(std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e const\u0026) /home/exiv2/app/actions.cpp:713:14\n    #7 0x522d02 in main /home/exiv2/app/exiv2.cpp:177:25\n    #8 0x7fd8230b6082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #9 0x4714dd in _start (/home/exiv2/build-v0.28.5/bin/exiv2+0x4714dd)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV /build/glibc-B3wQXB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:383 \n==376531==ABORTING\n```","status":"published","published":"2026-07-07T16:03:02.528413Z","modified":"2026-07-07T17:47:35.927454859Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"UBUNTU-CVE-2025-54080","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.","status":"published","published":"2025-08-29T15:15:00Z","modified":"2026-07-28T21:26:30.830395251Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"AZL-66711","title":"CVE-2025-54080 affecting package exiv2 0.28.3-1","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.","status":"published","published":"2025-08-29T15:15:35Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:23.841127Z"},{"id":"AZL-66764","title":"CVE-2025-54080 affecting package exiv2 0.28.0-1","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.","status":"published","published":"2025-08-29T15:15:35Z","modified":"2026-04-21T04:37:58.000742Z","updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"CLSA-2025-1766499581","title":"exiv2: Fix of CVE-2025-54080","description":"- CVE-2025-54080: fix insufficient bounds checking","status":"published","published":"2025-12-23T14:19:44Z","modified":"2026-06-01T00:31:34.055468757Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2025-1766500438","title":"exiv2: Fix of CVE-2025-54080","description":"- CVE-2025-54080: fix insufficient bounds checking","status":"published","published":"2025-12-23T14:34:02Z","modified":"2026-06-01T00:31:53.183752792Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"openSUSE-SU-2026:10298-1","title":"exiv2-0.28.8-1.1 on GA media","description":"These are all security issues fixed in the exiv2-0.28.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-07T00:00:00Z","modified":"2026-03-08T15:45:06.324786Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20410-1","title":"Security update for exiv2","description":"This update for exiv2 fixes the following issues:\n\nUpdate to exiv2 0.28.8:\n\n- CVE-2024-24826: out-of-bounds read in QuickTimeVideo: NikonTagsDecoder (bsc#1219870).\n- CVE-2024-25112: denial of service due to unbounded recursion in QuickTimeVideo: multipleEntriesDecoder (bsc#1219871).\n- CVE-2024-39695: out-of-bounds read in AsfVideo: streamProperties (bsc#1227528).\n- CVE-2025-26623: heap buffer overflow via writing metadata into a crafted image file (bsc#1237347).\n- CVE-2025-54080: out-of-bounds read in `Exiv2: EpsImage: writeMetadata()` when writing metadata into a crafted image\n  file (bsc#1248962).\n- CVE-2025-55304: quadratic performance algorithm in the ICC profile parsing code of `JpegBase: readMetadata`\n  (bsc#1248963).\n- CVE-2026-25884: out-of-bounds read in `CrwMap: decode0x0805` (bsc#1259083).\n- CVE-2026-27596: integer overflow in `LoaderNative: getData()` leads to out-of-bounds read (bsc#1259084).\n- CVE-2026-27631: crash due to uncaught exception when trying to create `std: vector` larger than `max_size()`\n  (bsc#1259085).\n","status":"published","published":"2026-03-23T09:44:37Z","modified":"2026-03-29T17:24:19.362881Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:20923-1","title":"Security update for exiv2","description":"This update for exiv2 fixes the following issues:\n\nUpdate to exiv2 0.28.8:\n\n- CVE-2024-24826: out-of-bounds read in QuickTimeVideo: NikonTagsDecoder (bsc#1219870).\n- CVE-2024-25112: denial of service due to unbounded recursion in QuickTimeVideo: multipleEntriesDecoder (bsc#1219871).\n- CVE-2024-39695: out-of-bounds read in AsfVideo: streamProperties (bsc#1227528).\n- CVE-2025-26623: heap buffer overflow via writing metadata into a crafted image file (bsc#1237347).\n- CVE-2025-54080: out-of-bounds read in `Exiv2: EpsImage: writeMetadata()` when writing metadata into a crafted image\n  file (bsc#1248962).\n- CVE-2025-55304: quadratic performance algorithm in the ICC profile parsing code of `JpegBase: readMetadata`\n  (bsc#1248963).\n- CVE-2026-25884: out-of-bounds read in `CrwMap: decode0x0805` (bsc#1259083).\n- CVE-2026-27596: integer overflow in `LoaderNative: getData()` leads to out-of-bounds read (bsc#1259084).\n- CVE-2026-27631: crash due to uncaught exception when trying to create `std: vector` larger than `max_size()`\n  (bsc#1259085).\n","status":"published","published":"2026-03-23T09:43:19Z","modified":"2026-04-02T17:24:22.48894Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2663-1","title":"Security update for exiv2","description":"This update for exiv2 fixes the following issues\n\n- CVE-2025-54080: out-of-bounds read in `Exiv2::EpsImage::writeMetadata()` when writing metadata into a crafted image\n  file (bsc#1248962).\n- CVE-2026-25884: out-of-bounds read in `CrwMap::decode0x0805` (bsc#1259083).\n- CVE-2026-27596: integer overflow in `LoaderNative::getData()` leads to out-of-bounds read (bsc#1259084).\n- CVE-2026-27631: crash due to uncaught exception when trying to create `std::vector` larger than `max_size()`\n  (bsc#1259085).\n","status":"published","published":"2026-06-26T14:04:28Z","modified":"2026-06-27T08:45:07.461350975Z","updated_at":"2026-11-02T15:54:04.519245Z"}]}}