PT-2025-35220 · Exiv2+5 · Exiv2+5

Dragonarthurx · Published 2025-01-01 · Updated 2026-03-23 · CVE-2025-54080

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Exiv2 versions 0.28.5 and earlier

Description Exiv2 is a C++ library and command-line utility used for reading, writing, deleting, and modifying image metadata (Exif, IPTC, XMP, and ICC). An out-of-bounds read vulnerability exists when Exiv2 writes metadata to a crafted image file. This can lead to a denial of service by crashing the application if a victim is tricked into processing a malicious image. The issue is triggered specifically during metadata writing, which is a less common operation than reading metadata.

Recommendations Exiv2 versions prior to 0.28.6 are affected. Update to version 0.28.6 or later to resolve this issue.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

CWE-407

Related Identifiers

ALT-PU-2025-11094

AZL-66711

AZL-66764

BDU:2025-13813

BDU:2025-13814

CVE-2025-54080

GHSA-496F-X7CQ-CQ39

OESA-2025-2113

OESA-2025-2114

OESA-2025-2115

OESA-2025-2116

OESA-2025-2117

OESA-2025-2274

OPENSUSE-SU-2026:10298-1

OPENSUSE-SU-2026:20410-1

SUSE-SU-2026:20923-1

USN-8103-1

Affected Products

Alt Linux

Debian

Exiv2

Linuxmint

Red Os

Ubuntu

References · 72

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54080.json · Exploit
• https://github.com/Exiv2/exiv2/commit/e737332427711f15bcdc4e903203d6b7493eaec0 · Patch
• https://ubuntu.com/security/CVE-2020-18899 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54080 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-54080 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8103-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13814 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-55304 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2274 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2117 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2115 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-54080 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10298-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20410-1 · Vendor Advisory