Niedrig

Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file

Veröffentlicht: 29.08.2025
Aktualisiert: 11.10.2026 13:19

Impact

An out-of-bounds read was found in Exiv2 versions v0.28.5 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file.

Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as delete.

Patches

The bug is fixed in version v0.28.6.

Credit

Thank you to @dragonArthurX for reporting this issue.

Details (from original report by @dragonArthurX )

Version: Tested on v0.28.5 (latest official release) Commit: 907169fa643c2c74c14fd4106e55eaeee3634d9f

Platform: Ubuntu 20.04.6 LTS (x86_64)

Build Steps:

bash

git clone https://github.com/Exiv2/exiv2.git
cd exiv2
git checkout v0.28.5
mkdir build-v0.28.5 && cd build-v0.28.5
cmake -DCMAKE_C_COMPILER=/fuzzer/afl-clang-fast -DCMAKE_CXX_COMPILER=/fuzzer/afl-clang-fast++ -DCMAKE_C_FLAGS="-g -fsanitize=address" -DCMAKE_CXX_FLAGS="-g -fsanitize=address" -DBUILD_SHARED_LIBS=OFF ../

Command line to reproduce:

bash

/home/exiv2/build/bin/exiv2 -d a -f /home/poc

Crash Output:

AddressSanitizer:DEADLYSIGNAL
 ================================================================ = 
==376531==ERROR: AddressSanitizer: SEGV on unknown address 0x7fd92236b0e7 (pc 0x7fd82314dcd2 bp 0x7ffd540ceba0 sp 0x7ffd540ce358 T0)
==376531==The signal is caused by a READ memory access.
    #0 0x7fd82314dcd2  /build/glibc-B3wQXB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:383
    #1 0x4ed131 in __asan_memcpy (/home/exiv2/build-v0.28.5/bin/exiv2+0x4ed131)
    #2 0x6184b1 in Exiv2::MemIo::write(unsigned char const*, unsigned long) /home/exiv2/src/basicio.cpp:704:5
    #3 0xad336d in (anonymous namespace)::writeTemp(Exiv2::BasicIo&, unsigned char const*, unsigned long) /home/exiv2/src/epsimage.cpp:90:14
    #4 0xac3a07 in (anonymous namespace)::readWriteEpsMetadata(Exiv2::BasicIo&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&, std::vector<Exiv2::NativePreview, std::allocator<Exiv2::NativePreview> >&, bool) /home/exiv2/src/epsimage.cpp:1009:7
    #5 0xad1175 in Exiv2::EpsImage::writeMetadata() /home/exiv2/src/epsimage.cpp:1103:3
    #6 0x5d2383 in Action::Erase::run(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/exiv2/app/actions.cpp:713:14
    #7 0x522d02 in main /home/exiv2/app/exiv2.cpp:177:25
    #8 0x7fd8230b6082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #9 0x4714dd in _start (/home/exiv2/build-v0.28.5/bin/exiv2+0x4714dd)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /build/glibc-B3wQXB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:383 
==376531==ABORTING

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

Plattform	Paket	Anfällige Versionen	Behoben in
Python (PyPI)	exiv2	<= 0.17.3	keine Korrektur

Verweise

CVSS-Wert -

CVSS-Vektor: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Schwäche (CWE): CWE-125
Plattform: Python (PyPI)
Paket: exiv2
Veröffentlicht: 29.08.2025
Aktualisiert: 11.10.2026 13:19

Quellen und Lizenzen

OSV / GitHub Advisory Database - PYSEC-2026-1354 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-496f-x7cq-cq39 - CC BY 4.0

Schwachstellenhistorie: exiv2

Alle veröffentlichten Schwachstellen dieses Pakets (Python (PyPI)), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (15) im Archiv

Einträge insgesamt: 15
Erste → letzte: 05.2017 08.2025
Ohne Fix: 12
In Angriffen ausgenutzt: 0

Verteilung nach Schweregrad

Hoch 3
Mittel 10
Niedrig 2

Veröffentlichungen pro Jahr

2017: 1
2018: 4
2019: 1
2020: 0
2021: 2
2022: 0
2023: 2
2024: 2
2025: 3
2026: 0

29.08.2025

Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file dieser Eintrag

Niedrig CVE-2025-54080 <= 0.17.3 keine Korrektur
06.11.2023

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds write was found in Exiv2 version v0.28.0. The vulnerable fu

Hoch · 8.8 CVE-2023-44398 alle Versionen keine Korrektur
22.08.2023

Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1 allows remote attackers to cause a denial of service and other unspecified impacts via use of crafted file.

Hoch · 7.8 CVE-2020-18831 alle Versionen keine Korrektur
26.07.2021

An integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap-based buffer overflow and cause a denial of service (DOS) via crafted metadata.

Hoch · 7.5 CVE-2021-31292 alle Versionen keine Korrektur

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden