Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A heap buffer overflow was found in Exiv2 versions v0.28.0 to v0.28.4. Versions prior to v0.28.0, such as v0.27.7, are **not** affected. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `fixiso`. The bug is fixed in version v0.28.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-7457 advisory.

    [0.28.3-3.2]
    - Revert: remove rpath patch       Resolves: RHEL-80106
    - Fix CVE-2025-26623 exiv2: Use After Free       Resolves: RHEL-80106

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7457 advisory.

    Exiv2 is a C++ library to access image metadata, supporting read and write access to the Exif, IPTC and     XMP metadata, Exif MakerNote support, extract and delete methods for Exif thumbnails, classes to access     Ifd, and support for various image formats.

    Security Fix(es):

    * exiv2: Use After Free in Exiv2 (CVE-2025-26623)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6ae77556-f31d-11ef-a695-4ccc6adda413 advisory.

    Kevin Backhouse reports:
    A heap buffer overflow was found in Exiv2 versions v0.28.0 to v0.28.4.
              Versions prior to v0.28.0, such as v0.27.7, are not affected. Exiv2 is a               command-line utility and C++ library for reading, writing, deleting, and               modifying the metadata of image files. The heap overflow is triggered when               Exiv2 is used to write metadata into a crafted image file. An attacker               could potentially exploit the vulnerability to gain code execution, if               they can trick the victim into running Exiv2 on a crafted image file.
    Note that this bug is only triggered when writing the metadata, which               is a less frequently used Exiv2 operation than reading the metadata. For               example, to trigger the bug in the Exiv2 command-line application, you               need to add an extra command-line argument such as fixiso.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
240866	Oracle Linux 10 : exiv2 (ELSA-2025-7457)	Nessus	Oracle Linux Local Security Checks	medium
237858	RHEL 10 : exiv2 (RHSA-2025:7457)	Nessus	Red Hat Local Security Checks	medium
216779	FreeBSD : exiv2 -- Use after free in TiffSubIfd (6ae77556-f31d-11ef-a695-4ccc6adda413)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2025-26623

medium

Tenable Plugins

medium

medium

medium