Description
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to modify the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when deleting the IPTC data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-d I rm`). The bug is fixed in version v0.27.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Exiv2 | exiv2 | <= 0.27.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | exiv2 | 0.27.5-1 | — |
| Debian 13 | exiv2 | 0.27.5-1 | — |
| Debian 12 | exiv2 | 0.27.5-1 | — |
| Debian 10 | exiv2 | 0.25-4+deb10u4 | DLA-3265-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | exiv2 | 0.27.3-3ubuntu4 | — |
| Ubuntu 20.04 LTS | exiv2 | 0.27.2-8ubuntu2.6 | USN-5043-1 |
| Ubuntu 18.04 LTS | exiv2 | 0.25-3.1ubuntu0.18.04.11 | USN-5043-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | exiv2 | 0.25-2.1ubuntu16.04.7+esm4 | USN-5043-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | exiv2 | 0.27.5-150400.15.4.1 | SUSE-SU-2022:3889-1 |
| SLES 15 SP4 | exiv2-0_26 | 0.26-150400.9.16.1 | SUSE-SU-2022:3889-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | exiv2 | 0.27.5-5.1 | openSUSE-SU-2024:12405-1 |
| openSUSE Leap 15.4 | exiv2 | 0.27.5-150400.15.4.1 | SUSE-SU-2022:3889-1 |
| openSUSE Leap 15.4 | exiv2-0_26 | 0.26-150400.9.16.1 | SUSE-SU-2022:3889-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | exiv2 | 0.27.5-r0 | — |
| Alpine v3.23 | exiv2 | 0.27.5-r0 | — |
| Alpine v3.22 | exiv2 | 0.27.5-r0 | — |
| Alpine v3.21 | exiv2 | 0.27.5-r0 | — |
| Alpine v3.20 | exiv2 | 0.27.5-r0 | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | exiv2 | 0.27.5-r0 | — |
| Alpine v3.18 | exiv2 | 0.27.5-r0 | — |
| Alpine v3.17 | exiv2 | 0.27.5-r0 | — |
| Alpine v3.16 | exiv2 | 0.27.5-r0 | — |
| Alpine v3.15 | exiv2 | 0.27.5-r0 | — |
| Alpine v3.14 | exiv2 | 0.27.5-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | exiv2 | 0.27.5-1 | — |
Advisories 4
- USN-5043-1 exiv2 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-3265-1 exiv2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:12405-1 exiv2-0.27.5-5.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2022:3889-1 Security update for exiv2 SUSE / openSUSE Security Updates · May 2, 2025
References
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-9jh3-fcc3-g6hv
- https://github.com/Exiv2/exiv2/pull/1788
- FEDORA-2021-399f869889 vendor-advisory
- FEDORA-2021-cbaef8e2d5 vendor-advisory
- [debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update mailing-list
- GLSA-202312-06 vendor-advisory