Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.
CVSS Details
- CVSS 4.0 Base Score: 1.8 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade exiv2 | Sep 1, 2025 | Aug 29, 2025 |
| Amazon Linux Ami 2 | — | Upgrade exiv2-libsUpgrade exiv2Upgrade exiv2-develUpgrade exiv2-debuginfoUpgrade exiv2-doc | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade exiv2-libsUpgrade exiv2-libs-debuginfoUpgrade exiv2-debuginfoUpgrade exiv2-develUpgrade exiv2Upgrade exiv2-debugsourceUpgrade exiv2-doc | Dec 9, 2025 | Aug 29, 2025 |
| Freebsd | — | Upgrade exiv2 | Dec 10, 2025 | Sep 4, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Aug 29, 2025 |
| Ubuntu | — | Upgrade libexiv2-28Upgrade exiv2Upgrade exiv2 (Ubuntu Pro)Upgrade libexiv2-devUpgrade libexiv2-27 (Ubuntu Pro)Upgrade libexiv2-27Upgrade libexiv2-dev (Ubuntu Pro) | Mar 19, 2026 | Aug 29, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub