Description

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.

INFO

Published Date :

2025-08-29T15:00:05.975Z

Last Modified :

2025-08-29T15:27:17.130Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2025-55304 vulnerability.

Vendors Products
Exiv2
  • Exiv2
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-55304.

URL Resource
https://github.com/Exiv2/exiv2/issues/3333 cve-icon cve-icon cve-icon
https://github.com/Exiv2/exiv2/pull/3335 cve-icon cve-icon cve-icon
https://github.com/Exiv2/exiv2/pull/3345 cve-icon cve-icon cve-icon
https://github.com/Exiv2/exiv2/security/advisories/GHSA-m54q-mm9w-fp6g cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-55304 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-55304 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact