CVE-2025-55304

A denial of service flaw was found in exiv2. A quadratic algorithm in the ICC profile parsing code in the jpegBase::readMetadata() function can cause Exiv2 to run for a long time. When Exiv2 is used to read the metadata of a crafted jpg image file, it triggers a denial of service.

Host Red Hat systems are not at risk of availability impact as a result of this flaw. In default configurations the availability impact is limited to the Exiv2 command line tool itself.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.