Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-54080: Exiv2 Crashes When Writing Metadata to Malicious EPS Files

CVE-2025-54080 · published 1 year ago

Summary

The Exiv2 library and utility can crash if used to write metadata to a specially crafted EPS file. This could happen if an attacker tricks someone into running Exiv2 on a malicious EPS file. To fix this, update to Exiv2 version 0.28.6 or later.

What to do

Update exiv2 exiv2 to version 0.28.6 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
pip	jim easterbrook	exiv2	<= 0.17.3
–	exiv2	exiv2	< 0.28.6 `cpe:2.3:a:exiv2:exiv2::::::::`

Original advisory text

Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.

References

https://github.com/Exiv2/exiv2/security/advisories/GHSA-496f-x7cq-cq39 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-54080 Vendor Advisory
https://github.com/advisories/GHSA-496f-x7cq-cq39
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54080... Vendor Advisory
https://github.com/Exiv2/exiv2/commit/e737332427711f15bcdc4e903203d6b7493eaec0 Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.8 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published29 Aug 2025

Updated26 Oct 2026

First seen6 Mar 2026

Sources

GHSA-496f-x7cq-cq39 · GHSA

CVE-2025-54080 · NVD

CVE-2025-54080 · OSV

Track software like this

Free during beta