Security Exception in Metadata Extractor: QuickTimeReader Vulnerability
Summary
OSV-2025-444: Security exception in com.drew.imaging.quicktime.QuickTimeReader.processAtoms. Affects metadata-extractor across 2 version ranges.
>= 0b566c0405424890b8e3f10d991f327af6922219, < ecffc649b1ff0e29cdac849546b66cf48480073a
>= 0c3452bf1c4556724930281ffd97f65b66bfd697
Fixed in ecffc649b1ff0e29cdac849546b66cf48480073a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Metadata Extractor is an open-source library designed for extracting metadata from various media file formats, including images and videos. It provides a simple API for developers to access metadata without needing to understand the underlying file formats. This library is widely used in applications that require media file analysis. However, a recent vulnerability has been identified in the QuickTimeReader component, which processes QuickTime file atoms, potentially leading to security exceptions during execution.
Vulnerability Detail
The vulnerability arises from a security exception in the QuickTimeReader's processAtoms method. This issue can lead to application crashes when handling specific media files, particularly those that contain malformed or unexpected atom structures. The crash occurs due to improper handling of byte streams, which can be exploited by attackers to disrupt service or cause denial of service. The vulnerability was reported through OSS-Fuzz, highlighting its potential impact on applications relying on the Metadata Extractor library.
How To Fix
Minimum fixed version
ecffc649b1ff0e29cdac849546b66cf48480073a
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation to check the structure of QuickTime files before processing them. This can help mitigate the risk of crashes due to malformed atoms. Additionally, consider using try-catch blocks around the QuickTimeReader methods to handle exceptions gracefully and prevent application crashes.
Conclusion
In summary, the Metadata Extractor library has a security vulnerability in the QuickTimeReader component that can lead to application crashes. It is crucial for developers using this library to update to the patched version to ensure the security and stability of their applications. Implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for metadata-extractor →
FAQ
The vulnerability is a security exception that occurs in the QuickTimeReader's processAtoms method, leading to potential application crashes.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to access the code.
If immediate updates are not possible, implement input validation and exception handling as a temporary workaround to reduce the risk of crashes.
Detailed information about the vulnerability can be found in the OSS-Fuzz report linked in the vulnerability details.
Yes, you should upgrade to the fixed version ecffc649b1ff0e29cdac849546b66cf48480073a to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for metadata-extractor.
