CVE-2025-26623 is a Critical heap buffer overflow (CVSS 9.8) in the Exiv2 image metadata library and tool, versions 0.28.0 to 0.28.4. It triggers when Exiv2 writes metadata into a crafted image. The fix is Exiv2 0.28.5. Versions before 0.28.0, such as 0.27.7, are not affected.
What's affected
- Product: Exiv2, a C++ library and command line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata
- Affected: 0.28.0 to 0.28.4
- Not affected: versions before 0.28.0, such as 0.27.7
- Fixed: 0.28.5
The advisory is specific about when the bug fires. It happens when Exiv2 is used to write metadata into a crafted image file. Reading metadata is not the trigger. The advisory notes that writing is a less frequently used operation than reading, and that in the command line tool you need an extra argument, such as fixiso, to reach it.
Exiv2 is a library, which means it may sit inside other software you run. Photo managers, desktop applications and image processing services can link to it, so the exposure in your estate may be larger than the number of times you installed the exiv2 package yourself.
How to check if you're exposed
Start with the command line tool and the system package:
exiv2 --version
dpkg -l | grep -i exiv2 # Debian and Ubuntu
rpm -qa | grep -i exiv2 # RHEL, Fedora, SUSE
brew list --versions exiv2 # macOS with Homebrew
A version from 0.28.0 to 0.28.4 is affected. Linux distributions often backport fixes without changing the upstream version number, so if the package version looks old, check your distribution's security tracker for this CVE before you decide.
For the library inside other software, look at what links to it:
ldconfig -p | grep -i exiv2
For container images and application builds, a dependency inventory is more reliable than a manual search. Safeguard's free in-browser scan accepts a dependency file and lists known issues.
What to do now
- Upgrade Exiv2 to 0.28.5 or later, or install your distribution's updated package.
- Rebuild and redeploy any application or container image that bundles Exiv2 statically or ships its own copy.
- Find the workflows where untrusted images are processed and metadata is written back, for example upload pipelines that strip or rewrite tags. Those are the places this bug is reachable.
- If you cannot patch yet, stop writing metadata to images from untrusted sources. The advisory says there are no known workarounds, so this is a risk reduction and not a fix.
- Keep the process that handles images on a low privilege account and in a sandbox where you can.
Why it matters
The advisory page maps the bug to CWE-416 (use after free), a use after free. The NVD record describes it as a heap buffer overflow. Both describe memory being handled wrongly, which can corrupt neighbouring data in the program. The advisory says an attacker could potentially gain code execution if they can trick the victim into running Exiv2 on a crafted image file.
Note that the GitHub advisory rates the issue Moderate, while the NVD record scores it 9.8 Critical. The difference is partly about how likely the write path is to be reached. The exact exposure depends on whether your software writes metadata from untrusted images. Where it does, patch first. It is not listed in the CISA Known Exploited Vulnerabilities catalog.
This is a good example of why a software inventory matters. A flaw in a library like this is invisible if you only track the applications you installed on purpose.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does reading metadata trigger CVE-2025-26623?
The advisory says the bug is triggered when writing metadata into a crafted image, which it calls less common than reading. It does not describe a trigger on read.
Is Exiv2 0.27.7 affected?
No. The advisory says versions before 0.28.0, such as 0.27.7, are not affected.
Sources
Check your own dependencies with the free in-browser scan.
Last reviewed: 19 October 2026.
