PT-2024-20754 · Exiv2+2 · Exiv2+2

Published 2024-02-12 · Updated 2026-03-23 · CVE-2024-25112

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Exiv2 versions v0.28.0 through v0.28.1

Description Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A denial-of-service was found in Exiv2, caused by an unbounded recursion that can cause Exiv2 to crash by exhausting the stack. The vulnerable function, QuickTimeVideo::multipleEntriesDecoder, was new in v0.28.0. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted video file.

Recommendations For Exiv2 versions v0.28.0 through v0.28.1, upgrade to version v0.28.2 to resolve the issue. As a temporary workaround, consider avoiding the use of the QuickTimeVideo::multipleEntriesDecoder function until a patch is available.

Exploit

Fix

DoS

Uncontrolled Recursion

Resource Exhaustion

Weakness Enumeration

CWE-674

CWE-400

Related Identifiers

ALT-PU-2024-2322

AZL-42515

AZL-42558

CVE-2024-25112

GHSA-CRMJ-QH74-2R36

OPENSUSE-SU-2024:13731-1

OPENSUSE-SU-2026:20410-1

PYSEC-2024-107

SUSE-SU-2026:20923-1

Affected Products

Alt Linux

Debian

Exiv2

References · 40

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25112.json · Exploit
• https://github.com/Exiv2/exiv2/security/advisories/GHSA-crmj-qh74-2r36 · Vendor Advisory
• https://github.com/Exiv2/exiv2/pull/2337 · Patch
• https://osv.dev/vulnerability/CVE-2024-25112 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-25112 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-42515 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-crmj-qh74-2r36 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13731-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25112 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:20410-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-42558 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-107 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20923-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-25112 · Vendor Advisory
• https://github.com/Exiv2/exiv2 · Note