CVE & CISA-KEV Catalog

CVE-2025-55304

MEDIUM
5.5
CVSS v3
NVD

Description

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.

CWE-407

How to fix

Remediation Available
exiv2Debian
Fixed in:0.28.7+dfsg-2CVE-2025-55304
exiv2Ubuntu
Fixed in:0.25-2.1ubuntu16.04.7+esm5USN-8103-1
Fixed in:0.25-3.1ubuntu0.18.04.11+esm1USN-8103-1
Fixed in:0.27.2-8ubuntu2.7+esm1USN-8103-1
Fixed in:0.27.2-8ubuntu2.7+esm3USN-8103-2
Fixed in:0.27.5-3ubuntu1.1USN-8103-1
Fixed in:0.27.5-3ubuntu1.3USN-8103-2
Fixed in:0.27.6-1ubuntu0.3USN-8103-2
Fixed in:0.27.6-1ubuntu0.1USN-8103-1
Fixed in:0.28.5+dfsg-1ubuntu0.1USN-8103-1
Fixed in:0.28.5+dfsg-1ubuntu0.3USN-8103-2
libexiv2-27Ubuntu
Fixed in:0.27.2-8ubuntu2.7+esm3USN-8103-2
Fixed in:0.27.5-3ubuntu1.3USN-8103-2
Fixed in:0.27.6-1ubuntu0.3USN-8103-2
libexiv2-28Ubuntu
Fixed in:0.28.5+dfsg-1ubuntu0.3USN-8103-2
libexiv2-devUbuntu
Fixed in:0.27.2-8ubuntu2.7+esm3USN-8103-2
Fixed in:0.27.5-3ubuntu1.3USN-8103-2
Fixed in:0.27.6-1ubuntu0.3USN-8103-2
Fixed in:0.28.5+dfsg-1ubuntu0.3USN-8103-2

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorLocal
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged

Impact

ConfidentialityNone
IntegrityNone
AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploit Intelligence

0.23%probability of exploitation in 30 days
13thpercentile

Low risk: more likely to be exploited than 13% of all known CVEs.

References

Exploit1
Third-Party Advisory1
Embed a live status badge for CVE-2025-55304
CVE-2025-55304 severity badge

Markdown

[![CVE-2025-55304](https://tridentstack.com/cve/badge/CVE-2025-55304.svg)](https://tridentstack.com/cve/CVE-2025-55304)

HTML

<a href="https://tridentstack.com/cve/CVE-2025-55304"><img src="https://tridentstack.com/cve/badge/CVE-2025-55304.svg" alt="CVE-2025-55304"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-09-02.