CVE-2025-55304lowCWE-407

CVE-2025-55304: fallo de gravedad baja en exiv2

Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata

Publicada el

Seguir esta CVE+ Monitorear exiv2+ Monitorear exiv2

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 1.8epss 0.3%
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Productos afectados
Exiv2 · exiv2
CVEs relacionadas — exiv2

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-29457—Heap buffer overflow in Exiv2::Jp2Image::doWriteMetadataEPSS 2.2%CVE-2021-29473LOWOut-of-bounds read in Exiv2::Jp2Image::doWriteMetadataEPSS 1.7%CVE-2021-29470MEDIUMOut-of-bounds read in Exiv2::Jp2Image::encodeJp2HeaderEPSS 1.6%CVE-2021-29458—Out-of-bounds read in Exiv2::Internal::CrwMap::encodeEPSS 1.6%CVE-2021-29464LOWHeap buffer overflow in Exiv2::Jp2Image::encodeJp2HeaderEPSS 1.5%CVE-2021-32617MEDIUMDenial of service in Exiv2EPSS 1.2%