bep/imagemeta allows excessively large EXIF data structures

Impact The EXIF data format allows for defining excessively large data structures in relatively small payloads. Before v0.10.0, If you didn't trust the input images, this could be abused to construct denial-of-service attacks. Patches v0.10.0 added LimitNumTags default 5000 and LimitTagSize defau...

GHSA-Q7RW-W4CQ-2J6W bep/imagemeta allows excessively large EXIF data structures

Impact The EXIF data format allows for defining excessively large data structures in relatively small payloads. Before v0.10.0, If you didn't trust the input images, this could be abused to construct denial-of-service attacks. Patches v0.10.0 added LimitNumTags default 5000 and LimitTagSize defau...

CVE-2025-32024 bep/imagemeta allows excessively large EXIF data structures

bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The EXIF data format allows for defining excessively large data structures in relatively small payloads. Before v0.10.0, If you didn't trust the input images, this could be abused to...

CVE-2025-32024

CVE-2025-32024 affects the Go library bep/imagemeta used to read EXIF/IPTC/XMP metadata from JPEG, TIFF, PNG, and WebP files. The root cause is that EXIF data can define excessively large data structures, enabling a potential denial-of-service when untrusted images are processed prior to v0.10.0....

CVE-2025-32024 bep/imagemeta allows excessively large EXIF data structures

bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The EXIF data format allows for defining excessively large data structures in relatively small payloads. Before v0.10.0, If you didn't trust the input images, this could be abused to...

CVE-2025-32024

bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The EXIF data format allows for defining excessively large data structures in relatively small payloads. Before v0.10.0, If you didn't trust the input images, this could be abused to...

CVE-2025-32024: Allocation of Resources Without Limits or Throttling

bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The EXIF data format allows for defining excessively large data structures in relatively small payloads. Before v0.10.0, If you didn't trust the input images, this could be abused to...

PT-2025-15446 · Unknown · Bep/Imagemeta

Name of the Vulnerable Software and Affected Versions: bep/imagemeta versions prior to 0.10.0 Description: The issue concerns a Go library for reading image meta data from various file formats. The EXIF data format allows for defining large data structures in small payloads, which could be abused...

Imagemeta security vulnerabilities

imagemeta is a Go library by the individual developer Bjørn Erik Pedersen. It is used to read EXIF, IPTC and XMP image metadata from JPEG, TIFF, PNG and WebP files. A security vulnerability exists in versions prior to imagemeta v0.10.0 that stems from an unrestricted number and size of EXIF data...

Linux Distros Unpatched Vulnerability : CVE-2016-10158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The exifconvertanytoint function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial ...

Linux Distros Unpatched Vulnerability : CVE-2015-0232

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The exifprocessunicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrar...

PT-2025-4863 · Unknown · Exif Viewer Classic

Name of the Vulnerable Software and Affected Versions: EXIF Viewer Classic versions 2.3.2 through 2.4.0 Description: The issue is caused by improper handling of EXIF meta data, leading to a cross-site scripting vulnerability. When an image is rendered and crafted EXIF meta data is processed, an...

Exif Viewer Cross-site Scripting Vulnerability

Exif Viewer is an Exif viewer from Exif Viewer Inc. to quickly access the Exif data of any image/photo seen in Google Chrome. A cross-site scripting vulnerability exists in Exif Viewer versions 2.3.2 and 2.4.0, which stems from improper handling of EXIF metadata and could lead to the execution of...

BIT-PHP-MIN-2020-7064 Use-of-uninitialized-value in exif

In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exifreaddata function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash...

Scrub EXIF Image Data in Your DevOps Pipeline

In this post, we’ll go over why you need to scrub EXIF image data and how to integrate this process into your DevOps pipeline...

Libexif Heap Buffer Overflow Info Disclosure

The vulnerability of the exifdatasavedataentry function in the exif-data.c component of the Libexif library for EXIF-file parsing involves reading data beyond the buffer’s allowed limits. Exploiting this vulnerability could allow an attacker to access confidential data...

GHSA-277C-5VVJ-9PWX Flooding Server with Thumbnail files

Details 1. All Imagick supported Fileformats are served without filtering The Thumbnail endpoint does not check against any filters what file formats should be served. We can transcode the image in all formats imagemagick supports. With that we can create Files that are much larger in filesize th...

PT-2024-23696 · WordPress · Nextgen Gallery

Name of the Vulnerable Software and Affected Versions: NextGEN Gallery plugin for WordPress versions up to and including 3.59 Description: The issue allows unauthorized access to data due to a missing capability check on the get item function. This enables unauthenticated attackers to extract...

DEBIAN-CVE-2024-28573

Buffer Overflow vulnerability in open source FreeImage v.3.19.0 r1909 allows a local attacker to cause a denial of service DoS via the jpegreadexifprofile function when reading images in JPEG format...

PT-2024-22480 · Freeimage +1 · Freeimage +1

Name of the Vulnerable Software and Affected Versions: FreeImage version 3.19.0 r1909 Description: A Null Pointer Dereference issue allows a local attacker to cause a denial of service DoS via the jpeg read exif profile raw function when reading images in JPEG format. Recommendations: For FreeIma...