{ "cveId": "CVE-2025-26623", "url": "https://patchblox.com/security/cve/CVE-2025-26623", "summary": "CVE-2025-26623 is fixed in 9 products on 1 platform, first by RHSA-2025:7457, released February 18, 2025. It is not reported as exploited. Patch Radar priority: High.", "title": "exiv2: Exiv2 is a C\u002B\u002B library and a command-line utility to read, write, deleteand modify Exif, IPTC, XMP and ICC image meta...", "description": "Exiv2 is a C\u002B\u002B library and a command-line utility to read, write, deleteand modify Exif, IPTC, XMP and ICC image metadata. A heap buffer overflowwas found in Exiv2 versions v0.28.0 to v0.28.4. Versions prior to v0.28.0,such as v0.27.7, are **not** affected. Exiv2 is a command-line utility andC\u002B\u002B library for reading, writing, deleting, and modifying the metadata ofimage files. The heap overflow is triggered when Exiv2 is used to writemetadata into a crafted image file. An attacker could potentially exploitthe vulnerability to gain code execution, if they can trick the victim intorunning Exiv2 on a crafted image file. Note that this bug is only triggeredwhen writing the metadata, which is a less frequently used Exiv2 operationthan reading the metadata. For example, to trigger the bug in the Exiv2command-line application, you need to add an extra command-line argumentsuch as \u0060fixiso\u0060. The bug is fixed in version v0.28.5. Users are advised toupgrade. There are no known workarounds for this vulnerability.", "published": "2025-02-18T19:24:31Z", "severity": "Medium", "cvss": 9.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "epss": 0.00916, "epssPercentile": 0.60418, "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "exiv2", "release": "Debian 13.5 (trixie)", "fixedVersion": "0.28.4\u002Bdfsg-2", "fix": "DEBIAN-CVE-2025-26623", "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-26623", "released": "2025-02-18T20:15:33Z" }, { "platform": "linux", "product": "exiv2", "release": "Debian 14", "fixedVersion": "0.28.4\u002Bdfsg-2", "fix": "DEBIAN-CVE-2025-26623", "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-26623", "released": "2025-02-18T20:15:33Z" }, { "platform": "linux", "product": "exiv2", "release": "RHEL 10", "fixedVersion": "0.28.3-3.el10_0.2", "fix": "RHSA-2025:7457", "url": "https://patchblox.com/security/fix/linux/rhsa-2025-7457", "released": "2025-02-18T19:24:31Z" }, { "platform": "linux", "product": "exiv2", "release": "Ubuntu 25.04 (plucky)", "fixedVersion": "0.28.4\u002Bdfsg-2", "fix": "exiv2 0.28.4\u002Bdfsg-2", "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-exiv2-0.28.4-dfsg-2", "released": "2026-01-16T01:42:25Z" }, { "platform": "linux", "product": "exiv2", "release": "almalinux 10", "fixedVersion": "0.28.3-3.el10_0.2", "fix": "ALSA-2025:7457", "url": "https://patchblox.com/security/fix/linux/alsa-2025-7457", "released": "2025-05-13T00:00:00Z" }, { "platform": "linux", "product": "exiv2", "release": "amzn 2023", "fixedVersion": "0.28.5-128.amzn2023", "fix": "ALAS2023-2025-1049", "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1049", "released": "2025-06-25T23:16:00Z" }, { "platform": "linux", "product": "exiv2", "release": "ol 10", "fixedVersion": "0:0.28.3-3.el10_0.2", "fix": "ELSA-2025-7457", "url": "https://patchblox.com/security/fix/linux/elsa-2025-7457", "released": "2025-06-27T00:00:00Z" }, { "platform": "linux", "product": "exiv2", "release": "opensuse-leap 16.0", "fixedVersion": "0.28.8-160000.1.1", "fix": "OPENSUSE-SU-2026:20410-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20410-1", "released": "2026-03-23T09:44:37Z" }, { "platform": "linux", "product": "exiv2", "release": "rocky 10", "fixedVersion": "0:0.28.3-3.el10_0.2", "fix": "RLSA-2025:7457", "url": "https://patchblox.com/security/fix/linux/rlsa-2025-7457", "released": "2025-10-03T19:56:45Z" }, { "platform": "linux", "product": "exiv2", "release": "sles 16.0", "fixedVersion": "0.28.8-160000.1.1", "fix": "SUSE-SU-2026:20923-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-20923-1", "released": "2026-03-23T09:43:19Z" }, { "platform": "linux", "product": "exiv2-debuginfo", "release": "amzn 2023", "fixedVersion": "0.28.5-128.amzn2023", "fix": "ALAS2023-2025-1049", "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1049", "released": "2025-06-25T23:16:00Z" }, { "platform": "linux", "product": "exiv2-debugsource", "release": "amzn 2023", "fixedVersion": "0.28.5-128.amzn2023", "fix": "ALAS2023-2025-1049", "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1049", "released": "2025-06-25T23:16:00Z" }, { "platform": "linux", "product": "exiv2-devel", "release": "almalinux 10", "fixedVersion": "0.28.3-3.el10_0.2", "fix": "ALSA-2025:7457", "url": "https://patchblox.com/security/fix/linux/alsa-2025-7457", "released": "2025-05-13T00:00:00Z" }, { "platform": "linux", "product": "exiv2-devel", "release": "amzn 2023", "fixedVersion": "0.28.5-128.amzn2023", "fix": "ALAS2023-2025-1049", "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1049", "released": "2025-06-25T23:16:00Z" }, { "platform": "linux", "product": "exiv2-devel", "release": "ol 10", "fixedVersion": "0:0.28.3-3.el10_0.2", "fix": "ELSA-2025-7457", "url": "https://patchblox.com/security/fix/linux/elsa-2025-7457", "released": "2025-06-27T00:00:00Z" }, { "platform": "linux", "product": "exiv2-doc", "release": "almalinux 10", "fixedVersion": "0.28.3-3.el10_0.2", "fix": "ALSA-2025:7457", "url": "https://patchblox.com/security/fix/linux/alsa-2025-7457", "released": "2025-05-13T00:00:00Z" }, { "platform": "linux", "product": "exiv2-doc", "release": "amzn 2023", "fixedVersion": "0.28.5-128.amzn2023", "fix": "ALAS2023-2025-1049", "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1049", "released": "2025-06-25T23:16:00Z" }, { "platform": "linux", "product": "exiv2-doc", "release": "ol 10", "fixedVersion": "0:0.28.3-3.el10_0.2", "fix": "ELSA-2025-7457", "url": "https://patchblox.com/security/fix/linux/elsa-2025-7457", "released": "2025-06-27T00:00:00Z" }, { "platform": "linux", "product": "exiv2-libs", "release": "almalinux 10", "fixedVersion": "0.28.3-3.el10_0.2", "fix": "ALSA-2025:7457", "url": "https://patchblox.com/security/fix/linux/alsa-2025-7457", "released": "2025-05-13T00:00:00Z" }, { "platform": "linux", "product": "exiv2-libs", "release": "amzn 2023", "fixedVersion": "0.28.5-128.amzn2023", "fix": "ALAS2023-2025-1049", "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1049", "released": "2025-06-25T23:16:00Z" }, { "platform": "linux", "product": "exiv2-libs", "release": "ol 10", "fixedVersion": "0:0.28.3-3.el10_0.2", "fix": "ELSA-2025-7457", "url": "https://patchblox.com/security/fix/linux/elsa-2025-7457", "released": "2025-06-27T00:00:00Z" }, { "platform": "linux", "product": "exiv2-libs-debuginfo", "release": "amzn 2023", "fixedVersion": "0.28.5-128.amzn2023", "fix": "ALAS2023-2025-1049", "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1049", "released": "2025-06-25T23:16:00Z" }, { "platform": "linux", "product": "libexiv2-28", "release": "Ubuntu 25.04 (plucky)", "fixedVersion": "0.28.4\u002Bdfsg-2", "fix": "libexiv2-28 0.28.4\u002Bdfsg-2", "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-libexiv2-28-0.28.4-dfsg-2", "released": "2026-01-16T01:42:25Z" }, { "platform": "linux", "product": "libexiv2-data", "release": "Ubuntu 25.04 (plucky)", "fixedVersion": "0.28.4\u002Bdfsg-2", "fix": "libexiv2-data 0.28.4\u002Bdfsg-2", "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-libexiv2-data-0.28.4-dfsg-2", "released": "2026-01-16T01:42:25Z" } ], "noFixYet": [], "dataAsOf": "2026-11-09T01:18:40Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }