CVE-2021-32617 - CVE House
Back to Database
Status published Medium CVE-2021-32617

Denial of service in Exiv2

Vulnerability Description

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An inefficient algorithm (quadratic complexity) was found in Exiv2 versions v0.27.3 and earlier. The inefficient algorithm is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4. Note that this bug is only triggered when _writing_ the metadata, which is a less frequently used Exiv2 operation than _reading_ the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `rm`.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-32617

Credits & Attribution

No credits recorded in the NVD database.

References

More from Exiv2

View All →
CVE-2025-55304
Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata
Low 1.8
CVE-2025-54080
Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file
Low 1.8
CVE-2025-26623
Use After Free in Exiv2
Medium 5.3
CVE-2024-39695
Exiv2 has an out-of-bounds read in AsfVideo::streamProperties
Medium 5.3
CVE-2024-25112
Denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder in Exiv2
Medium 5.5

Affected Vendor

Affected Software

exiv2
Vulnerable Versions:
<= 0.27.3

Timeline

Official Publish: May 17th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact