Heap Buffer Overflow in Exiv2 Package: CVE-2025-26623
Summary
UBUNTU-CVE-2025-26623: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Affects exiv2 versions < 0.28.4+dfsg-2. Fixed in 0.28.4+dfsg-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Exiv2 is a C++ library and command-line utility designed for reading, writing, deleting, and modifying metadata in image files, including Exif, IPTC, XMP, and ICC formats. It is widely used for managing image metadata and is available in various distributions, including Ubuntu. The vulnerability in question affects versions 0.28.0 to 0.28.4 of Exiv2, which can lead to severe security risks if exploited.
Vulnerability Detail
A heap buffer overflow vulnerability was identified in Exiv2 versions 0.28.0 to 0.28.4. This vulnerability is triggered when Exiv2 is used to write metadata into a specially crafted image file. An attacker could exploit this flaw to execute arbitrary code if they can convince a victim to run Exiv2 on the malicious image. The issue arises specifically during the writing of metadata, which is less common than reading metadata. The vulnerability is fixed in version 0.28.5.
How To Fix
Minimum fixed version
0.28.4+dfsg-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade exiv2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. The best course of action is to upgrade to the fixed version.
Conclusion
The vulnerability CVE-2025-26623 in the Exiv2 package poses a significant risk due to the potential for code execution via a heap buffer overflow. Users are advised to upgrade to version 0.28.5 to mitigate this risk, as no workarounds are available.
See every vulnerability recorded for exiv2 →
FAQ
CVE-2025-26623 is a vulnerability in the Exiv2 package that allows for a heap buffer overflow, potentially leading to code execution.
Exiv2 versions 0.28.0 to 0.28.4 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Currently, there are no workarounds available. It is strongly recommended to upgrade to the patched version as soon as possible.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for exiv2.
