{"id":"CVE-2025-55304","aliases":["ALPINE-CVE-2025-55304","AZL-66708","AZL-66767","CLSA-2025-1760106873","CLSA-2025-1766136361","DEBIAN-CVE-2025-55304","EUVD-2025-26206","GHSA-m54q-mm9w-fp6g","JLSEC-2026-1315","OESA-2025-2116","OESA-2025-2117","OESA-2025-2274","PYSEC-2026-1355","SUSE-SU-2026:0231-1","SUSE-SU-2026:20923-1","UBUNTU-CVE-2025-55304","USN-8103-2","openSUSE-SU-2026:10298-1","openSUSE-SU-2026:20410-1"],"status":"published","title":"Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.","severity":{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00254,"percentile":0.17004,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-407"],"published":"2025-08-29T14:59:37Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"exiv2","fixed_in":["0.28.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"exiv2","fixed_in":["0.28.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"exiv2","fixed_in":["0.28.6-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"exiv2","fixed_in":["0.27.5-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"exiv2-devel","fixed_in":["0.27.5-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"exiv2-doc","fixed_in":["0.27.5-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"exiv2-libs","fixed_in":["0.27.5-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"exiv2","fixed_in":["0.27.5-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"exiv2-devel","fixed_in":["0.27.5-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"exiv2-doc","fixed_in":["0.27.5-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"exiv2-libs","fixed_in":["0.27.5-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"exiv2","fixed_in":["0.28.7+dfsg-2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"exiv2-0_26","fixed_in":["0.26-150400.9.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"exiv2-0_26","fixed_in":["0.26-150400.9.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"exiv2-0_26","fixed_in":["0.26-150400.9.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"exiv2-0_26","fixed_in":["0.26-150400.9.27.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"exiv2-0_26","fixed_in":["0.26-150400.9.27.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exiv2","fixed_in":["0.27.2-8ubuntu2.7+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"exiv2","fixed_in":["0.27.5-3ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"exiv2","fixed_in":["0.27.6-1ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"exiv2","fixed_in":["0.28.5+dfsg-1ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.17.3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.6-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.28.3-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.28.0-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exiv2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exiv2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exiv2-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exiv2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exiv2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"exiv2-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.27.6-1","0.28.0+dfsg-1","0.28.0+dfsg-2","0.28.0+dfsg-3","0.28.0+dfsg-4","0.28.1+dfsg-1","0.28.1+dfsg-2","0.28.1+dfsg-3","0.28.2+dfsg-1","0.28.3+dfsg-1","0.28.3+dfsg-2","0.28.4+dfsg-1","0.28.4+dfsg-2","0.28.5+dfsg-1","0.28.7+dfsg-1","0.28.7+dfsg-2","0.28.8+dfsg-1","0.28.9+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28.5+dfsg-1","0.28.7+dfsg-1","0.28.7+dfsg-2","0.28.8+dfsg-1","0.28.9+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.7+dfsg-2"}]}],"versions":["0.28.5+dfsg-1","0.28.7+dfsg-1"]},{"source":"osv","ecosystem":"PyPI","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.17.3"}]}],"versions":["0.1","0.11.0","0.11.1","0.11.2","0.11.3","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.14.0","0.14.1","0.15.0","0.16.0","0.16.1","0.16.2","0.16.2.post1","0.16.3","0.16.3.post1","0.17.0","0.17.1","0.17.2","0.17.3","0.2","0.3","0.3.1"]},{"source":"osv","ecosystem":"Julia","package":"Exiv2_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.2-4.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.2-4.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.2-4.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.17.3"}]}],"versions":["0.1","0.11.0","0.11.1","0.11.2","0.11.3","0.12.0","0.12.1","0.13.0","0.13.1","0.13.2","0.14.0","0.14.1","0.15.0","0.16.0","0.16.1","0.16.2","0.16.2.post1","0.16.3","0.16.3.post1","0.17.0","0.17.1","0.17.2","0.17.3","0.2","0.3","0.3.1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"exiv2-0_26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150400.9.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"exiv2-0_26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150400.9.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"exiv2-0_26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150400.9.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"exiv2-0_26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150400.9.27.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"exiv2-0_26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150400.9.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.8-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.8-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.25-4ubuntu2","0.25-4ubuntu3","0.27.2-8ubuntu2","0.27.2-8ubuntu2.2","0.27.2-8ubuntu2.4","0.27.2-8ubuntu2.5","0.27.2-8ubuntu2.6","0.27.2-8ubuntu2.7","0.27.2-8ubuntu2.7+esm1","0.27.2-8ubuntu2.7+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.27.3-3ubuntu4","0.27.3-3.1ubuntu1","0.27.5-1ubuntu1","0.27.5-3ubuntu1","0.27.5-3ubuntu1.1","0.27.5-3ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.27.6-1","0.27.6-1build1","0.27.6-1ubuntu0.1","0.27.6-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28.5+dfsg-1","0.28.5+dfsg-1ubuntu0.1","0.28.5+dfsg-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-8ubuntu2.7+esm3"}]}],"versions":["0.25-4ubuntu2","0.25-4ubuntu3","0.27.2-8ubuntu2","0.27.2-8ubuntu2.2","0.27.2-8ubuntu2.4","0.27.2-8ubuntu2.5","0.27.2-8ubuntu2.6","0.27.2-8ubuntu2.7","0.27.2-8ubuntu2.7+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-3ubuntu1.3"}]}],"versions":["0.27.3-3ubuntu4","0.27.3-3.1ubuntu1","0.27.5-1ubuntu1","0.27.5-3ubuntu1","0.27.5-3ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.6-1ubuntu0.3"}]}],"versions":["0.27.6-1","0.27.6-1build1","0.27.6-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.5+dfsg-1ubuntu0.3"}]}],"versions":["0.28.5+dfsg-1","0.28.5+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.8-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.8-160000.1.1"}]}],"bundled":9}],"products":[{"vendor":"exiv2","product":"exiv2"}],"references":[{"url":"https://github.com/Exiv2/exiv2/security/advisories/GHSA-m54q-mm9w-fp6g","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/Exiv2/exiv2/issues/3333","tags":["x_refsource_MISC","Exploit","Issue Tracking","report","web"]},{"url":"https://github.com/Exiv2/exiv2/pull/3335","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/Exiv2/exiv2/pull/3345","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55304","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-m54q-mm9w-fp6g","tags":["web","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-55304","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1760106873.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2025-1766136361.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55304.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-55304","tags":["advisory"]},{"url":"https://github.com/Exiv2/exiv2","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54080","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2117","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2274","tags":["advisory"]},{"url":"https://pypi.org/project/exiv2","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260231-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248963","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55304","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620923-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219870","tags":["report"]},{"url":"https://bugzilla.suse.com/1219871","tags":["report"]},{"url":"https://bugzilla.suse.com/1227528","tags":["report"]},{"url":"https://bugzilla.suse.com/1237347","tags":["report"]},{"url":"https://bugzilla.suse.com/1248962","tags":["report"]},{"url":"https://bugzilla.suse.com/1259083","tags":["report"]},{"url":"https://bugzilla.suse.com/1259084","tags":["report"]},{"url":"https://bugzilla.suse.com/1259085","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-26623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27631","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-55304","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55304","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8103-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8103-2","tags":["advisory"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/gimp/+bug/2144731","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-55304","title":"Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.","status":"published","published":"2025-08-29T15:00:05.975Z","modified":"2025-08-29T15:27:17.13Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:32:52.839698Z"}],"euvd":[{"id":"EUVD-2025-26206","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.","status":"published","published":"2025-08-29T15:00:05Z","modified":"2025-08-29T15:27:17Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T20:31:49.600955Z"}],"ghsa":[{"id":"GHSA-m54q-mm9w-fp6g","title":"Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata","description":"### Impact\nA denial-of-service was found in Exiv2 version v0.28.5: a quadratic algorithm in the ICC profile parsing code in `jpegBase::readMetadata()` can cause Exiv2 to run for a long time. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file.\n\n### Patches\nThe bug is fixed in version v0.28.6.\n\n### References\nIssue: https://github.com/Exiv2/exiv2/issues/3333\nFixes: https://github.com/Exiv2/exiv2/pull/3335 (main branch), https://github.com/Exiv2/exiv2/pull/3345 (0.28.x branch)\n\n### For more information\nPlease see our [security policy](https://github.com/Exiv2/exiv2/security/policy) for information about Exiv2 security.","status":"published","published":"2025-08-29T14:59:37Z","modified":"2025-08-29T21:04:02Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:38:55.953734Z"}],"nvd":[{"id":"CVE-2025-55304","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.","status":"published","published":"2025-08-29T15:15:35.95Z","modified":"2026-10-19T17:10:00.173Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:11:26.200344Z"}],"osv":[{"id":"ALPINE-CVE-2025-55304","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.","status":"published","published":"2025-08-29T15:15:35.95Z","modified":"2026-11-03T06:33:00.797485815Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2025-55304","title":"Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.","status":"published","published":"2025-08-29T15:00:05.975Z","modified":"2026-10-28T02:30:39.911267136Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:44:50.863921Z"},{"id":"DEBIAN-CVE-2025-55304","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.","status":"published","published":"2025-08-29T15:15:35.95Z","modified":"2026-10-23T17:47:31.937960479Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-m54q-mm9w-fp6g","title":"Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata","description":"### Impact\nA denial-of-service was found in Exiv2 version v0.28.5: a quadratic algorithm in the ICC profile parsing code in `jpegBase::readMetadata()` can cause Exiv2 to run for a long time. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file.\n\n### Patches\nThe bug is fixed in version v0.28.6.\n\n### References\nIssue: https://github.com/Exiv2/exiv2/issues/3333\nFixes: https://github.com/Exiv2/exiv2/pull/3335 (main branch), https://github.com/Exiv2/exiv2/pull/3345 (0.28.x branch)\n\n### For more information\nPlease see our [security policy](https://github.com/Exiv2/exiv2/security/policy) for information about Exiv2 security.","status":"published","published":"2025-08-29T14:59:37Z","modified":"2026-07-07T17:56:54.761170872Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"JLSEC-2026-1315","title":"Exiv2 has quadratic performance in ICC profile parsing in `JpegBase::readMetadata`","description":"### Impact\n\nA denial-of-service was found in Exiv2 version v0.28.5: a quadratic algorithm in the ICC profile parsing code in `jpegBase::readMetadata()` can cause Exiv2 to run for a long time. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file.\n\n### Patches\n\nThe bug is fixed in version v0.28.6.\n\n### References\n\nIssue: https://github.com/Exiv2/exiv2/issues/3333\nFixes: https://github.com/Exiv2/exiv2/pull/3335 (main branch), https://github.com/Exiv2/exiv2/pull/3345 (0.28.x branch)\n\n### For more information\n\nPlease see our [security policy](https://github.com/Exiv2/exiv2/security/policy) for information about Exiv2 security.","status":"published","published":"2026-08-13T15:55:58.236Z","modified":"2026-08-13T16:13:48.19122669Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2025-2116","title":"exiv2 security update","description":"Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as problematic, was found in exiv2 up to 0.28.5 (Image Processing Software).CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying the patch e737332427711f15bcdc4e903203d6b7493eaec0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54080)\n\nA vulnerability was found in exiv2 up to 0.28.5 (Image Processing Software). It has been classified as problematic.CWE is classifying the issue as CWE-407. An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55304)","status":"published","published":"2025-09-05T11:09:12Z","modified":"2026-08-18T01:18:09.078011394Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2117","title":"exiv2 security update","description":"Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as problematic, was found in exiv2 up to 0.28.5 (Image Processing Software).CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying the patch e737332427711f15bcdc4e903203d6b7493eaec0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54080)\n\nA vulnerability was found in exiv2 up to 0.28.5 (Image Processing Software). It has been classified as problematic.CWE is classifying the issue as CWE-407. An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55304)","status":"published","published":"2025-09-05T11:09:12Z","modified":"2026-08-18T01:18:09.09602503Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2274","title":"exiv2 security update","description":"Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as problematic, was found in exiv2 up to 0.28.5 (Image Processing Software).CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying the patch e737332427711f15bcdc4e903203d6b7493eaec0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54080)\n\nA vulnerability was found in exiv2 up to 0.28.5 (Image Processing Software). It has been classified as problematic.CWE is classifying the issue as CWE-407. An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-55304)","status":"published","published":"2025-09-12T11:09:20Z","modified":"2026-08-18T01:19:10.172204904Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"PYSEC-2026-1355","title":"Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata","description":"### Impact\nA denial-of-service was found in Exiv2 version v0.28.5: a quadratic algorithm in the ICC profile parsing code in `jpegBase::readMetadata()` can cause Exiv2 to run for a long time. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file.\n\n### Patches\nThe bug is fixed in version v0.28.6.\n\n### References\nIssue: https://github.com/Exiv2/exiv2/issues/3333\nFixes: https://github.com/Exiv2/exiv2/pull/3335 (main branch), https://github.com/Exiv2/exiv2/pull/3345 (0.28.x branch)\n\n### For more information\nPlease see our [security policy](https://github.com/Exiv2/exiv2/security/policy) for information about Exiv2 security.","status":"published","published":"2026-07-07T16:03:02.626933Z","modified":"2026-07-07T17:47:35.88535625Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"UBUNTU-CVE-2025-55304","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.","status":"published","published":"2025-08-29T15:15:00Z","modified":"2026-07-28T21:26:30.975999667Z","cvss":[{"version":"4.0","score":1.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"AZL-66708","title":"CVE-2025-55304 affecting package exiv2 0.28.3-1","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.","status":"published","published":"2025-08-29T15:15:35Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:23.841127Z"},{"id":"AZL-66767","title":"CVE-2025-55304 affecting package exiv2 0.28.0-1","description":"Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.","status":"published","published":"2025-08-29T15:15:35Z","modified":"2026-04-21T04:37:58.067579Z","updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"CLSA-2025-1760106873","title":"exiv2: Fix of CVE-2025-55304","description":"- CVE-2025-55304: add new method appendIccProfile to fix quadratic\n  performance issue","status":"published","published":"2025-10-10T14:34:41Z","modified":"2026-06-01T00:31:18.795586449Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1766136361","title":"exiv2: Fix of CVE-2025-55304","description":"- CVE-2025-55304: add new method appendIccProfile to fix quadratic\n  performance issue","status":"published","published":"2025-12-19T09:30:25Z","modified":"2026-06-01T00:32:37.736364541Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"openSUSE-SU-2026:10298-1","title":"exiv2-0.28.8-1.1 on GA media","description":"These are all security issues fixed in the exiv2-0.28.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-07T00:00:00Z","modified":"2026-03-08T15:45:06.324786Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20410-1","title":"Security update for exiv2","description":"This update for exiv2 fixes the following issues:\n\nUpdate to exiv2 0.28.8:\n\n- CVE-2024-24826: out-of-bounds read in QuickTimeVideo: NikonTagsDecoder (bsc#1219870).\n- CVE-2024-25112: denial of service due to unbounded recursion in QuickTimeVideo: multipleEntriesDecoder (bsc#1219871).\n- CVE-2024-39695: out-of-bounds read in AsfVideo: streamProperties (bsc#1227528).\n- CVE-2025-26623: heap buffer overflow via writing metadata into a crafted image file (bsc#1237347).\n- CVE-2025-54080: out-of-bounds read in `Exiv2: EpsImage: writeMetadata()` when writing metadata into a crafted image\n  file (bsc#1248962).\n- CVE-2025-55304: quadratic performance algorithm in the ICC profile parsing code of `JpegBase: readMetadata`\n  (bsc#1248963).\n- CVE-2026-25884: out-of-bounds read in `CrwMap: decode0x0805` (bsc#1259083).\n- CVE-2026-27596: integer overflow in `LoaderNative: getData()` leads to out-of-bounds read (bsc#1259084).\n- CVE-2026-27631: crash due to uncaught exception when trying to create `std: vector` larger than `max_size()`\n  (bsc#1259085).\n","status":"published","published":"2026-03-23T09:44:37Z","modified":"2026-03-29T17:24:19.362881Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0231-1","title":"Security update for exiv2-0_26","description":"This update for exiv2-0_26 fixes the following issues:\n\nAdd reference for previously fixed issue:\n\n- CVE-2025-55304: Fixed quadratic performance algorithm in the ICC profile parsing code of `JpegBase::readMetadata` (bsc#1248963).\n","status":"published","published":"2026-01-22T12:22:53Z","modified":"2026-03-23T04:52:03.017531Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:20923-1","title":"Security update for exiv2","description":"This update for exiv2 fixes the following issues:\n\nUpdate to exiv2 0.28.8:\n\n- CVE-2024-24826: out-of-bounds read in QuickTimeVideo: NikonTagsDecoder (bsc#1219870).\n- CVE-2024-25112: denial of service due to unbounded recursion in QuickTimeVideo: multipleEntriesDecoder (bsc#1219871).\n- CVE-2024-39695: out-of-bounds read in AsfVideo: streamProperties (bsc#1227528).\n- CVE-2025-26623: heap buffer overflow via writing metadata into a crafted image file (bsc#1237347).\n- CVE-2025-54080: out-of-bounds read in `Exiv2: EpsImage: writeMetadata()` when writing metadata into a crafted image\n  file (bsc#1248962).\n- CVE-2025-55304: quadratic performance algorithm in the ICC profile parsing code of `JpegBase: readMetadata`\n  (bsc#1248963).\n- CVE-2026-25884: out-of-bounds read in `CrwMap: decode0x0805` (bsc#1259083).\n- CVE-2026-27596: integer overflow in `LoaderNative: getData()` leads to out-of-bounds read (bsc#1259084).\n- CVE-2026-27631: crash due to uncaught exception when trying to create `std: vector` larger than `max_size()`\n  (bsc#1259085).\n","status":"published","published":"2026-03-23T09:43:19Z","modified":"2026-04-02T17:24:22.48894Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"USN-8103-2","title":"exiv2 regression","description":"USN-8103-1 fixed vulnerabilities in Exiv2. The update caused a regression\nfor Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and\nUbuntu 25.10. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that Exiv2 did not correctly handle reading certain\n buffers. An attacker could possibly use this issue to leak sensitive\n information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04\n LTS. (CVE-2020-18771)\n\n Wen Cheng discovered that Exiv2 did not correctly handle certain memory\n allocation. If a user or system were tricked into opening a specially\n crafted file, an attacker could possibly use this issue to cause a denial\n of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.\n (CVE-2020-18899)\n\n It was discovered that Exiv2 did not correctly handle writing certain\n metadata. If a user or system were tricked into opening a specially crafted\n file, an attacker could possibly use this issue to cause a denial of\n service. (CVE-2025-54080)\n\n It was discovered that Exiv2 did not correctly handle parsing certain\n metadata. If a user or system were tricked into opening a specially crafted\n file, an attacker could possibly use this issue to cause a denial of\n service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\n Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-55304)\n\n It was discovered that Exiv2 did not correctly handle parsing certain\n images. If a user or system were tricked into opening a specially crafted\n file, an attacker could possibly use this issue to cause a denial of\n service. (CVE-2026-25884)\n\n It was discovered that Exiv2 did not correctly handle previewing certain\n images. An attacker could possibly use this issue to cause a denial of\n service. (CVE-2026-27596)\n\n It was discovered that Exiv2 did not correctly handle certain integer\n arithmetic. An attacker could possibly use this issue to cause a denial of\n service. (CVE-2026-27631)","status":"published","published":"2026-03-19T07:08:49Z","modified":"2026-04-27T18:43:37.461068Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}