Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A denial-of-service was found in Exiv2 version v0.28.1: an unbounded recursion can cause Exiv2 to crash by exhausting the stack. The vulnerable function, `QuickTimeVideo::multipleEntriesDecoder`, was new in v0.28.0, so Exiv2 versions before v0.28 are _not_ affected. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted video file. This bug is fixed in version v0.28.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade exiv2 | Aug 22, 2024 | Feb 12, 2024 |
| Amazon Linux Ami 2 | — | Upgrade exiv2-develUpgrade exiv2-debuginfoUpgrade exiv2-docUpgrade exiv2Upgrade exiv2-libs | Jan 10, 2025 | Feb 12, 2024 |
| Debian | — | Upgrade exiv2 | May 15, 2025 | Feb 12, 2024 |
| Suse | — | Upgrade libexiv2-28-x86-64-v3Upgrade libexiv2-28 | Dec 5, 2025 | Dec 5, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub