Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata.
Exiv2 is a C++ library and command-line utility for handling image metadata. An out-of-bounds read vulnerability exists in Exiv2 versions 0.28.5 and earlier, triggered when writing metadata to a crafted image file. Exploitation could cause a denial of service by crashing the application. The vulnerability only occurs during metadata writing, which is less common than reading. The issue is fixed in version 0.28.6.
AI Analysis
Technical Summary
Exiv2 versions up to 0.28.5 contain an out-of-bounds read vulnerability that can be triggered when writing metadata into a specially crafted image file. This vulnerability may lead to a denial of service by crashing Exiv2. The flaw does not affect metadata reading operations. The vulnerability is resolved in version 0.28.6.
Potential Impact
Successful exploitation can cause denial of service by crashing Exiv2 when processing crafted image files during metadata writing. There is no indication of code execution or data disclosure. The impact is limited to application availability during the write operation.
Mitigation Recommendations
A fix is available in Exiv2 version 0.28.6. Users and administrators should upgrade to version 0.28.6 or later to remediate this vulnerability. Until upgraded, avoid processing untrusted image files with Exiv2 metadata writing functionality.
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata.
Description
Exiv2 is a C++ library and command-line utility for handling image metadata. An out-of-bounds read vulnerability exists in Exiv2 versions 0.28.5 and earlier, triggered when writing metadata to a crafted image file. Exploitation could cause a denial of service by crashing the application. The vulnerability only occurs during metadata writing, which is less common than reading. The issue is fixed in version 0.28.6.
CVSS v4.0
Affected software
pkg:deb/ubuntu/[email protected]+esm5?arch=source&distro=esm-infra/xenialpkg:deb/ubuntu/[email protected]+esm1?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/[email protected]+esm1?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/[email protected]?arch=source&distro=jammypkg:deb/ubuntu/[email protected]?arch=source&distro=noblepkg:deb/ubuntu/[email protected]+dfsg-1ubuntu0.1?arch=source&distro=questingRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Exiv2 versions up to 0.28.5 contain an out-of-bounds read vulnerability that can be triggered when writing metadata into a specially crafted image file. This vulnerability may lead to a denial of service by crashing Exiv2. The flaw does not affect metadata reading operations. The vulnerability is resolved in version 0.28.6.
Potential Impact
Successful exploitation can cause denial of service by crashing Exiv2 when processing crafted image files during metadata writing. There is no indication of code execution or data disclosure. The impact is limited to application availability during the write operation.
Mitigation Recommendations
A fix is available in Exiv2 version 0.28.6. Users and administrators should upgrade to version 0.28.6 or later to remediate this vulnerability. Until upgraded, avoid processing untrusted image files with Exiv2 metadata writing functionality.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2025-54080
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:25.10"]
- Cvss Version
- 4.0
Threat ID: 6a6942099c2644c7f86ced11
Added to database: 07/28/2026, 23:58:01 UTC
Last enriched: 07/29/2026, 10:55:53 UTC
Last updated: 09/11/2026, 22:06:30 UTC
Views: 69
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.