# exiv2 (PyPI) vulnerabilities

15 known vulnerabilities (1 high, 4 medium, 2 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pypi.org/project/exiv2/

## Advisories (15)

### [CVE-2025-55304](https://cve.now/CVE-2025-55304): Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata

- Severity: Low 1.8
- Published: Aug 29, 2025
- Affected: through 0.17.3.

### [CVE-2025-54080](https://cve.now/CVE-2025-54080): Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file

- Severity: Low 1.8
- Published: Aug 29, 2025
- Affected: through 0.17.3.

### [CVE-2025-26623](https://cve.now/CVE-2025-26623): Use After Free in Exiv2

- Severity: Medium 5.3
- Published: Feb 18, 2025
- Affected: from 0.28.0, fixed in 0.28.5.

### [CVE-2024-24826](https://cve.now/CVE-2024-24826): Out-of-bounds read in QuickTimeVideo::NikonTagsDecoder in Exiv2

- Severity: Medium 5.5
- Published: Feb 12, 2024
- Affected: from 0.16.0, fixed in 0.16.1.

### [CVE-2024-25112](https://cve.now/CVE-2024-25112): Denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder in Exiv2

- Severity: Medium 5.5
- Published: Feb 12, 2024
- Affected: from 0.16.0, fixed in 0.16.1.

### [CVE-2023-44398](https://cve.now/CVE-2023-44398): Out-of-bounds write in exiv2

- Severity: High 8.8
- Published: Nov 6, 2023
- Affected: all versions.

### [CVE-2020-18831](https://cve.now/CVE-2020-18831): Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1 allows remote attackers to cause a denial of…

- Severity: Unrated
- Published: Aug 22, 2023
- Affected: all versions.

### [CVE-2020-18899](https://cve.now/CVE-2020-18899): An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of…

- Severity: Medium 6.5
- Published: Aug 19, 2021
- Affected: all versions.

### [CVE-2021-31292](https://cve.now/CVE-2021-31292): An integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap-based buffer overflow and cause a denial of…

- Severity: Unrated
- Published: Jul 26, 2021
- Affected: all versions.

### [CVE-2019-13114](https://cve.now/CVE-2019-13114): http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by…

- Severity: Unrated
- Published: Jun 30, 2019
- Affected: version range not reported.

### [CVE-2018-20099](https://cve.now/CVE-2018-20099): There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3.

- Severity: Unrated
- Published: Dec 12, 2018
- Affected: all versions.

### [CVE-2018-20098](https://cve.now/CVE-2018-20098): There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3.

- Severity: Unrated
- Published: Dec 12, 2018
- Affected: all versions.

### [CVE-2018-20096](https://cve.now/CVE-2018-20096): There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3.

- Severity: Unrated
- Published: Dec 12, 2018
- Affected: all versions.

### [CVE-2018-20097](https://cve.now/CVE-2018-20097): There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage\_int.cpp in Exiv2 0.27-RC3.

- Severity: Unrated
- Published: Dec 12, 2018
- Affected: all versions.

### [CVE-2017-9239](https://cve.now/CVE-2017-9239): An issue was discovered in Exiv2 0.26.

- Severity: Unrated
- Published: May 26, 2017
- Affected: all versions.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/exiv2
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.