CVE-2025-54080: Exiv2 Metadata Library DOS Vulnerability

CVE-2025-54080 Overview

CVE-2025-54080 is an out-of-bounds read vulnerability [CWE-125] in Exiv2, a C++ library and command-line utility used to read, write, delete, and modify Exif, IPTC, XMP, and ICC image metadata. The flaw affects Exiv2 versions 0.28.5 and earlier. It is triggered when Exiv2 writes metadata into a crafted image file, specifically during processing of DOS EPS signatures in src/epsimage.cpp. An attacker who tricks a victim into running Exiv2 on a malicious file can cause the process to crash, resulting in denial of service. The bug is fixed in version 0.28.6.

Critical Impact
Local denial of service through Exiv2 process crash when writing metadata to a specially crafted image file. Exploitation requires user interaction and does not affect confidentiality or integrity.

Affected Products

Exiv2 versions 0.28.5 and earlier
Applications and image pipelines linking the Exiv2 library for metadata writing
Command-line workflows using the exiv2 utility to modify EPS metadata

Discovery Timeline

2025-08-29 - CVE-2025-54080 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54080

Vulnerability Analysis

The vulnerability resides in the EPS image handler in src/epsimage.cpp. When Exiv2 processes an image with a DOS EPS signature, the code reads structural offsets from the header without adequately validating that the underlying buffer contains enough bytes for the subsequent read operations. On a crafted file, this leads to an out-of-bounds read past the end of the input buffer.

The bug surfaces only in the write path, which is a less common operation than reading metadata. Because the read occurs on attacker-controlled offsets in EPS header fields such as posEps, posEndEps, and posWmf, the process can crash and terminate the calling application. The vulnerability does not permit code execution or disclosure of memory to a remote party; the practical impact is denial of service against local Exiv2 consumers.

Root Cause

The root cause is missing bounds enforcement before parsing EPS offset fields. The pre-patch code checked size < 30 and threw an error, but the error path did not consistently reflect the operation mode, and downstream reads at computed offsets could still exceed the buffer during writes on malformed inputs.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted EPS image and convinces the victim to invoke Exiv2 to write or update metadata on that file. Automated pipelines that call Exiv2 on untrusted uploads to modify metadata are the most exposed integration path.

cpp

// Patch excerpt from src/epsimage.cpp
   uint32_t posTiff = 0;
   uint32_t sizeTiff = 0;
 
+  ErrorCode errcode = write ? ErrorCode::kerImageWriteFailed : ErrorCode::kerFailedToReadImageData;
+
   // check for DOS EPS
   const bool dosEps =
       (size >= dosEpsSignature.size() && memcmp(data, dosEpsSignature.data(), dosEpsSignature.size()) == 0);
   if (dosEps) {
 #ifdef DEBUG
     EXV_DEBUG << "readWriteEpsMetadata: Found DOS EPS signature\n";
 #endif
-    if (size < 30) {
-#ifndef SUPPRESS_WARNINGS
-      EXV_WARNING << "Premature end of file after DOS EPS signature.\n";
-#endif
-      throw Error(write ? ErrorCode::kerImageWriteFailed : ErrorCode::kerFailedToReadImageData);
-    }
+
+    enforce(size >= 30, errcode);
     posEps = getULong(data + 4, littleEndian);
     posEndEps = getULong(data + 8, littleEndian) + posEps;
     posWmf = getULong(data + 12, littleEndian);

Source: Exiv2 patch commit e737332. The fix replaces the manual size check with an enforce macro that raises the appropriate ErrorCode for either the read or write path, ensuring the guard is applied consistently before offsets are dereferenced.

Detection Methods for CVE-2025-54080

Indicators of Compromise

Unexpected termination or crash logs from processes that embed or invoke exiv2 while writing metadata
Core dumps referencing epsimage.cpp frames or getULong offsets past mapped buffer regions
EPS files whose header offsets at bytes 4, 8, and 12 point outside the file size

Detection Strategies

Inventory systems for installed Exiv2 versions using package managers or SBOM data and flag versions at or below 0.28.5
Inspect build manifests and container images for libexiv2 and the exiv2 CLI to identify vulnerable copies bundled with image processing services
Alert on repeated non-zero exit codes from image processing workers that call Exiv2 write operations on user-supplied files

Monitoring Recommendations

Monitor image ingestion pipelines for spikes in EPS parsing failures during metadata write operations
Log invocations of exiv2 with write subcommands and correlate with source file provenance
Track upstream advisories for downstream distributions that repackage libexiv2

How to Mitigate CVE-2025-54080

Immediate Actions Required

Upgrade Exiv2 to version 0.28.6 or later on all systems that read or write image metadata
Rebuild and redeploy applications that statically link libexiv2 after upgrading the dependency
Restrict metadata write operations to trusted image sources until patches are applied

Patch Information

The fix landed in Exiv2 0.28.6. See the GitHub Security Advisory GHSA-496f-x7cq-cq39 and the Exiv2 patch commit e737332 for details. The patch introduces a consistent bounds check using the enforce macro before parsing DOS EPS header offsets.

Workarounds

Avoid using Exiv2 to write metadata into untrusted EPS files until the patched version is installed
Filter or reject EPS uploads at the application boundary if metadata writing cannot be disabled
Run Exiv2-invoking workers under process isolation so that a crash does not affect the parent service

bash

# Verify installed Exiv2 version and upgrade
exiv2 --version | head -n 1

# Debian/Ubuntu
apt-get update && apt-get install --only-upgrade exiv2 libexiv2-27

# From source
git clone https://github.com/Exiv2/exiv2.git
cd exiv2 && git checkout v0.28.6
cmake -B build -S . && cmake --build build --target install