CVE-2025-55304 LOW

CVE-2025-55304: Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata

Vendor Exiv2
Product exiv2
Weakness CWE-407
Published August 29, 2025
Last update August 29, 2025
View on NVD All CVEs

CVSS base score

1.8/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.

Key dates

02Disclosure timeline

August 29, 2025 CVE published
August 29, 2025 Record updated