The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-387e64c9fd advisory.

    Exiv2 0.28.6 + patch to fix silent abi breakage

    ----

    Exiv2 v0.28.6 (Fixes two low severity CVEs)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006187 advisory.

    Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and     ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-     bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could     potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick     the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing     the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed     in version 0.28.6.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-e5ab9a2288 advisory.

    Update to exiv2-0.28.7, fixes CVE-2025-54080 and CVE-2025-55304.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0843 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-55304:
    Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and     ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the     ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-     of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is     fixed in version 0.28.6.

    CVE-2025-54080:
    Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and     ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-     bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could     potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick     the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing     the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed     in version 0.28.6.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1296 advisory.

    Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and     ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-     bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could     potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick     the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing     the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed     in version 0.28.6. (CVE-2025-54080)

    Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and     ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the     ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-     of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is     fixed in version 0.28.6. (CVE-2025-55304)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20410-1 advisory.

    Update to exiv2 0.28.8:

    - CVE-2024-24826: out-of-bounds read in QuickTimeVideo: NikonTagsDecoder (bsc#1219870).
    - CVE-2024-25112: denial of service due to unbounded recursion in QuickTimeVideo: multipleEntriesDecoder     (bsc#1219871).
    - CVE-2024-39695: out-of-bounds read in AsfVideo: streamProperties (bsc#1227528).
    - CVE-2025-26623: heap buffer overflow via writing metadata into a crafted image file (bsc#1237347).
    - CVE-2025-54080: out-of-bounds read in `Exiv2: EpsImage: writeMetadata()` when writing metadata into a     crafted image       file (bsc#1248962).
    - CVE-2025-55304: quadratic performance algorithm in the ICC profile parsing code of `JpegBase:
    readMetadata`       (bsc#1248963).
    - CVE-2026-25884: out-of-bounds read in `CrwMap: decode0x0805` (bsc#1259083).
    - CVE-2026-27596: integer overflow in `LoaderNative: getData()` leads to out-of-bounds read (bsc#1259084).
    - CVE-2026-27631: crash due to uncaught exception when trying to create `std: vector` larger than     `max_size()`       (bsc#1259085).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 84a77710-8958-11f0-b6e5-4ccc6adda413 advisory.

    Kevin Backhouse reports:
    An out-of-bounds read was found in Exiv2 versions v0.28.5 and earlier.
              Exiv2 is a command-line utility and C++ library for reading, writing,               deleting, and modifying the metadata of image files. The out-of-bounds               read is triggered when Exiv2 is used to write metadata into a crafted               image file. An attacker could potentially exploit the vulnerability to               cause a denial of service by crashing Exiv2, if they can trick the victim               into running Exiv2 on a crafted image file.
    Note that this bug is only triggered when writing the metadata, which               is a less frequently used Exiv2 operation than reading the metadata. For               example, to trigger the bug in the Exiv2 command-line application, you               need to add an extra command-line argument such as delete.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-e1ae3d4ed9 advisory.

    Exiv2 0.28.6 + patch to fix silent abi breakage

    ----

    Exiv2 v0.28.6 (Fixes two low severity CVEs)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c23727e694 advisory.

    Exiv2 0.28.6 + patch to fix silent abi breakage

    ----

    Exiv2 v0.28.6 (Fixes two low severity CVEs)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-99df814c62 advisory.

    Update to exiv2-0.28.7, fixes CVE-2025-54080 and CVE-2025-55304.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of exiv2 installed on the remote host is prior to 0.27.0-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3086 advisory.

    Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and     ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-     bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could     potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick     the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing     the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed     in version 0.28.6. (CVE-2025-54080)

    Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and     ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the     ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-     of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is     fixed in version 0.28.6. (CVE-2025-55304)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8103-1 advisory.

    It was discovered that Exiv2 did not correctly handle reading certain buffers. An attacker could possibly     use this issue to leak sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04     LTS. (CVE-2020-18771)

    Wen Cheng discovered that Exiv2 did not correctly handle certain memory allocation. If a user or system     were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a     denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-18899)

    It was discovered that Exiv2 did not correctly handle writing certain metadata. If a user or system were     tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial     of service. (CVE-2025-54080)

    It was discovered that Exiv2 did not correctly handle parsing certain metadata. If a user or system were     tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial     of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu     25.10. (CVE-2025-55304)

    It was discovered that Exiv2 did not correctly handle parsing certain images. If a user or system were     tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial     of service. (CVE-2026-25884)

    It was discovered that Exiv2 did not correctly handle previewing certain images. An attacker could     possibly use this issue to cause a denial of service. (CVE-2026-27596)

    It was discovered that Exiv2 did not correctly handle certain integer arithmetic. An attacker could     possibly use this issue to cause a denial of service. (CVE-2026-27631)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and     ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-     bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could     potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick     the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing     the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed     in version 0.28.6. (CVE-2025-54080)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
260148	Fedora 42 : exiv2 (2025-387e64c9fd)	Nessus	Fedora Local Security Checks	9/1/2025	3/10/2026	low
302277	Unity Linux 20.1070e Security Update: exiv2 (UTSA-2026-006187)	Nessus	Unity Linux Local Security Checks	3/15/2026	3/15/2026	low
271171	Fedora 41 : inih / mingw-exiv2 (2025-e5ab9a2288)	Nessus	Fedora Local Security Checks	10/22/2025	10/22/2025	low
272241	TencentOS Server 4: exiv2 (TSSA-2025:0843)	Nessus	Tencent Local Security Checks	11/4/2025	12/4/2025	low
277793	Amazon Linux 2023 : exiv2, exiv2-devel, exiv2-libs (ALAS2023-2025-1296)	Nessus	Amazon Linux Local Security Checks	12/9/2025	3/10/2026	low
304230	openSUSE 16 Security Update : exiv2 (openSUSE-SU-2026:20410-1)	Nessus	SuSE Local Security Checks	3/29/2026	3/29/2026	medium
261418	FreeBSD : exiv2 -- Out-of-bounds read in Exiv2::EpsImage::writeMetadata() (84a77710-8958-11f0-b6e5-4ccc6adda413)	Nessus	FreeBSD Local Security Checks	9/5/2025	3/10/2026	low
261222	Fedora 41 : exiv2 (2025-e1ae3d4ed9)	Nessus	Fedora Local Security Checks	9/4/2025	3/10/2026	low
264844	Fedora 43 : exiv2 (2025-c23727e694)	Nessus	Fedora Local Security Checks	9/15/2025	3/10/2026	low
270556	Fedora 42 : inih / mingw-exiv2 (2025-99df814c62)	Nessus	Fedora Local Security Checks	10/15/2025	10/15/2025	low
277764	Amazon Linux 2 : exiv2, --advisory ALAS2-2025-3086 (ALAS-2025-3086)	Nessus	Amazon Linux Local Security Checks	12/8/2025	3/10/2026	low
303030	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Exiv2 vulnerabilities (USN-8103-1)	Nessus	Ubuntu Local Security Checks	3/19/2026	3/19/2026	medium
260733	Linux Distros Unpatched Vulnerability : CVE-2025-54080	Nessus	Misc.	9/3/2025	4/29/2026	low

Detections

Analytics

Plugins Search

low

low

low

low

low

medium

low

low

low

low

low

medium

low