PT-2022-16763 · Unknown+1 · Metadata-Extractor+1

Huang Wenjie + 2 · Published 2022-02-24 · Updated 2025-09-12 · CVE-2022-24614

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions metadata-extractor versions up to 2.16.0

Description The issue allows an attacker to cause a denial of service by allocating large amounts of memory when reading a specially crafted JPEG file, potentially affecting services that use the metadata-extractor library. This can lead to an out-of-memory error even with very small inputs.

Recommendations For metadata-extractor versions up to 2.16.0, update to a version later than 2.16.0 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2022-24614

GHSA-4V6P-CXF9-98RF

OESA-2024-1023

OESA-2024-1024

OESA-2024-1025

OESA-2024-1054

Affected Products

Debian

Metadata-Extractor

References · 24

• 🔥 https://github.com/drewnoakes/metadata-extractor/issues/561 · Exploit
• https://osv.dev/vulnerability/GHSA-4v6p-cxf9-98rf · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-24614 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-24614 · Security Note
• https://osv.dev/vulnerability/OESA-2024-1025 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24614 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24614 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24613 · Security Note
• https://osv.dev/vulnerability/OESA-2024-1023 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1024 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-24614 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24614 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24614 · Vendor Advisory
• https://github.com/drewnoakes/metadata-extractor/commit/85ec243df54133a87f9d928d2278595f52b07519 · Note