Read the docs
TI-2024-16567 Aliases CVE-2024-25112GHSA-crmj-qh74-2r36

Denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder in Exiv2

Priority LOW 24CWE-400Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A denial-of-service was found in Exiv2 version v0.28.1: an unbounded recursion can cause Exiv2 to crash by exhausting the stack. The vulnerable function, `QuickTimeVideo::multipleEntriesDecoder`, was new in v0.28.0, so Exiv2 versions before v0.28 are _not_ affected. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted video file. This bug is fixed in version v0.28.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0022 12th percentileScored 2026-11-07
Fix Fixed exiv2 (PyPI): 0.16.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Exiv2exiv2>= 0.28.0 < 0.28.2—No fix listedCNA
—exiv2 (PyPI)0.16.0 to before 0.16.10.16.1Patch availableGHSA-crmj-qh74-2r36
  • exiv2 VendorExiv2 Affected >= 0.28.0 < 0.28.2 Fixed in — No fix listed CNA
  • exiv2 (PyPI) Vendor— Affected 0.16.0 to before 0.16.1 Fixed in 0.16.1 Patch available GHSA-crmj-qh74-2r36

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:exiv2:exiv2:0.28.0:*:*:*:*:*:*:*0.28.0VulnerableExiv2
cpe:2.3:a:exiv2:exiv2:0.28.1:*:*:*:*:*:*:*0.28.1VulnerableExiv2
  • cpe:2.3:a:exiv2:exiv2:0.28.0:*:*:*:*:*:*:* Versions 0.28.0 Vulnerable ·Exiv2
  • cpe:2.3:a:exiv2:exiv2:0.28.1:*:*:*:*:*:*:* Versions 0.28.1 Vulnerable ·Exiv2

Remediation

  • Fix · GHSA-crmj-qh74-2r36 exiv2 (PyPI) Fixed in 0.16.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-25112
  2. 2026-10-03 Alias added: GHSA-crmj-qh74-2r36

References

Patch 1

Advisory 2

Other 2

  • TI-2020-13478 Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1… CVSS 3.1HIGH 7.8
  • TI-2025-19560 Use After Free in Exiv2 CVSS 4.0MEDIUM 5.3
  • TI-2020-13491 An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of… CVSS 3.1MEDIUM 6.5
  • TI-2018-08245 Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp. CVSS 3.0CRITICAL 9.8
  • TI-2025-33923 Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file CVSS 4.0LOW 1.8
  • TI-2019-06608 An issue was discovered in Exiv2 0.27. CVSS 3.0HIGH 8.8
See all 123 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences