CVE-2025-55304: Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata

August 29, 2025 (updated November 10, 2025)

A denial-of-service was found in Exiv2 version v0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file.

References

github.com/Exiv2/exiv2
github.com/Exiv2/exiv2/issues/3333
github.com/Exiv2/exiv2/pull/3335
github.com/Exiv2/exiv2/pull/3345
github.com/Exiv2/exiv2/security/advisories/GHSA-m54q-mm9w-fp6g
github.com/advisories/GHSA-m54q-mm9w-fp6g
nvd.nist.gov/vuln/detail/CVE-2025-55304

Code Behaviors & Features

Detect and mitigate CVE-2025-55304 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →