---
id: CVE-2025-55304
aliases:
  - GHSA-m54q-mm9w-fp6g
  - PYSEC-2026-1355
title: >-
  Exiv2 has quadratic performance in ICC profile parsing in
  JpegBase::readMetadata
summary: >-
  Exiv2 has quadratic performance in ICC profile parsing in
  JpegBase::readMetadata
severity: low
vendor: exiv2
product: exiv2
ecosystem: pip
affected:
  - exiv2 <= 0.17.3
published: '2025-08-29'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-m54q-mm9w-fp6g'
references:
  - url: 'https://github.com/Exiv2/exiv2/security/advisories/GHSA-m54q-mm9w-fp6g'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-55304'
  - url: 'https://github.com/Exiv2/exiv2/issues/3333'
  - url: 'https://github.com/Exiv2/exiv2/pull/3335'
  - url: 'https://github.com/Exiv2/exiv2/pull/3345'
  - url: 'https://github.com/Exiv2/exiv2'
tags:
  - osv
  - pip
epss: 0.00242
epssPercentile: 0.13658
ingestedAt: '2026-07-08T18:25:51.132Z'
---

## Overview

### Impact
A denial-of-service was found in Exiv2 version v0.28.5: a quadratic algorithm in the ICC profile parsing code in `jpegBase::readMetadata()` can cause Exiv2 to run for a long time. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file.

### Patches
The bug is fixed in version v0.28.6.

### References
Issue: https://github.com/Exiv2/exiv2/issues/3333
Fixes: https://github.com/Exiv2/exiv2/pull/3335 (main branch), https://github.com/Exiv2/exiv2/pull/3345 (0.28.x branch)

### For more information
Please see our [security policy](https://github.com/Exiv2/exiv2/security/policy) for information about Exiv2 security.

## Affected packages

- `exiv2 <= 0.17.3`

## Remediation

Refer to the advisory for the patched release.