Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.

Affected: PyPI: Exiv2

### Impact An out-of-bounds read was found in Exiv2 versions v0.28.5 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file.

Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as delete.

### Patches The bug is fixed in version v0.28.6.

### Credit Thank you to @dragonArthurX for reporting this issue.

### Details (from original report by @dragonArthurX ) **Version:** Tested on v0.28.5 (latest official release) Commit: 907169fa643c2c74c14fd4106e55eaeee3634d9f

**Platform:** Ubuntu 20.04.6 LTS (x86_64)

**Build Steps:** ```bash git clone https://github.com/Exiv2/exiv2.git cd exiv2 git checkout v0.28.5 mkdir build-v0.28.5 && cd build-v0.28.5 cmake -DCMAKE_C_COMPILER=/fuzzer/afl-clang-fast -DCMAKE_CXX_COMPILER=/fuzzer/afl-clang-fast++ -DCMAKE_C_FLAGS="-g -fsanitize=address" -DCMAKE_CXX_FLAGS="-g -fsanitize=address" -DBUILD_SHARED_LIBS=OFF ../ ```

**Command line to reproduce:** ```bash /home/exiv2/build/bin/exiv2 -d a -…

Affected: openEuler:20.03-LTS-SP4: exiv2

Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats. Security Fix(es):

A vulnerability, which was classified as problematic, was found in exiv2 up to 0.28.5 (Image Processing Software).CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying the patch e737332427711f15bcdc4e903203d6b7493eaec0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54080)

exiv2-0.28.8-1.1 on GA media

Affected: PyPI: exiv2

### Impact An out-of-bounds read was found in Exiv2 versions v0.28.5 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file.

Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as delete.

### Patches The bug is fixed in version v0.28.6.

### Credit Thank you to @dragonArthurX for reporting this issue.

### Details (from original report by @dragonArthurX ) **Version:** Tested on v0.28.5 (latest official release) Commit: 907169fa643c2c74c14fd4106e55eaeee3634d9f

**Platform:** Ubuntu 20.04.6 LTS (x86_64)

**Build Steps:** ```bash git clone https://github.com/Exiv2/exiv2.git cd exiv2 git checkout v0.28.5 mkdir build-v0.28.5 && cd build-v0.28.5 cmake -DCMAKE_C_COMPILER=/fuzzer/afl-clang-fast -DCMAKE_CXX_COMPILER=/fuzzer/afl-clang-fast++ -DCMAKE_C_FLAGS="-g -fsanitize=address" -DCMAKE_CXX_FLAGS="-g -fsanitize=address" -DBUILD_SHARED_LIBS=OFF ../ ```

**Command line to reproduce:** ```bash /home/exiv2/build/bin/exiv2 -d a -…

Security update for exiv2

Affected: Ubuntu:Pro:16.04:LTS: exiv2, Ubuntu:Pro:18.04:LTS: exiv2, Ubuntu:Pro:20.04:LTS: exiv2, Ubuntu:22.04:LTS: exiv2, Ubuntu:24.04:LTS: exiv2, Ubuntu:25.10: exiv2

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.