CVE-2025-55304: Exiv2 Denial-of-Service Vulnerability

CVE-2025-55304 Overview

CVE-2025-55304 is a denial-of-service vulnerability in Exiv2, a widely used C++ library and command-line utility for reading, writing, and modifying image metadata such as Exif, IPTC, XMP, and ICC profiles. The flaw exists in version 0.28.5 and stems from a quadratic-complexity algorithm in the International Color Consortium (ICC) profile parsing logic within jpegBase::readMetadata(). A crafted JPEG file can cause Exiv2 to consume excessive CPU time when its metadata is parsed. The issue is classified under [CWE-407: Inefficient Algorithmic Complexity] and is fixed in Exiv2 version 0.28.6.

Critical Impact
A crafted JPEG file processed by Exiv2 0.28.5 can trigger prolonged CPU consumption, causing denial of service in applications and pipelines that rely on Exiv2 for metadata extraction.

Affected Products

Exiv2 version 0.28.5
Applications and image-processing pipelines embedding the Exiv2 C++ library
Command-line workflows invoking the exiv2 utility on untrusted JPEG input

Discovery Timeline

2025-08-29 - CVE-2025-55304 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55304

Vulnerability Analysis

The vulnerability is an algorithmic complexity flaw in Exiv2's JPEG metadata reader. When Exiv2 parses ICC color profiles embedded in a JPEG file, the routine in jpegBase::readMetadata() executes operations whose runtime grows quadratically with the size of the crafted input. An attacker who controls a JPEG file can therefore force disproportionate CPU consumption relative to the input size.

Exploitation requires local processing of the malicious file and user action to invoke Exiv2 against it. Impact is limited to availability: the host process may stall or become unresponsive while parsing continues. Confidentiality and integrity are not affected. The bug does not corrupt memory or allow code execution.

Exiv2 is embedded in many image viewers, digital asset management systems, and batch conversion tools. Automated pipelines that invoke Exiv2 on user-supplied JPEGs — for example thumbnailers, indexers, or forensic tools — inherit the exposure and can be stalled by a single crafted file.

Root Cause

The root cause is an inefficient algorithm inside the ICC profile parsing path of jpegBase::readMetadata(). The routine performs work that scales with the square of the profile-related input length rather than linearly. Version 0.28.6 replaces the quadratic logic with a linear-time implementation, as tracked in Exiv2 issue #3333 and resolved by pull request #3335 and pull request #3345.

Attack Vector

An attacker crafts a JPEG file containing ICC profile data structured to maximize the quadratic path. The victim, or an automated process acting on the victim's behalf, invokes Exiv2 to read metadata from the file. Exiv2 then enters a prolonged parsing loop, monopolizing a CPU core and delaying or preventing other work. Delivery vectors include email attachments, uploads to services that call Exiv2 server-side, and shared media libraries.

No verified public proof-of-concept code is available. The vulnerability mechanism is documented in GitHub Security Advisory GHSA-m54q-mm9w-fp6g.

Detection Methods for CVE-2025-55304

Indicators of Compromise

Exiv2 processes sustaining high CPU utilization for extended periods while parsing a single JPEG file
Image-processing worker queues stalling on specific user-submitted JPEG inputs
Timeouts or watchdog terminations of processes invoking exiv2 or linking libexiv2

Detection Strategies

Inventory hosts and container images for Exiv2 0.28.5 using software composition analysis or package managers such as dpkg -l | grep exiv2 and rpm -qa | grep exiv2
Monitor runtime CPU consumption of processes that link libexiv2 and alert on sustained single-core saturation tied to image parsing
Instrument image-ingestion services with per-file processing time limits and log outliers for review

Monitoring Recommendations

Forward process telemetry and resource metrics from image-processing hosts into a centralized analytics platform for anomaly detection
Track file hashes of JPEGs that trigger parser timeouts and correlate uploads across tenants or users
Review third-party applications that bundle Exiv2 and confirm their patch status against upstream releases

How to Mitigate CVE-2025-55304

Immediate Actions Required

Upgrade Exiv2 to version 0.28.6 or later on all affected systems and container images
Rebuild and redeploy downstream applications that statically link or vendor the Exiv2 library
Enforce CPU and wall-clock timeouts on any process invoking Exiv2 against untrusted input

Patch Information

The fix is included in Exiv2 0.28.6. The upstream commits landed via pull request #3335 and pull request #3345, which replace the quadratic ICC profile parsing logic in jpegBase::readMetadata() with a linear-time implementation. Refer to GHSA-m54q-mm9w-fp6g for the coordinated advisory.

Workarounds

Avoid running Exiv2 against JPEG files received from untrusted sources until the upgrade is complete
Sandbox metadata extraction in a separate process with strict ulimit CPU and memory quotas
Apply an ingestion-side file size cap on JPEG uploads to reduce the maximum attainable parsing time

bash

# Enforce a CPU-time limit on Exiv2 invocations against untrusted files
ulimit -t 5
timeout 5s exiv2 -pS /path/to/untrusted.jpg