CVE-2005-0406 json
A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, which could lead to an i…
published 2005-02-14 21 y ago modified 2026-06-16 4 mo ago also EUVD-2005-0407
- cvss
- 5.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, which could lead to an information leak of potentially sensitive visual information that had been removed from the main JPEG image.
Exploit prediction
0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- redteam-pentesting.de http://www.redteam-pentesting.de/advisories/rt-sa-2005-008.txt referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
References
-
redteam-pentesting.de
/advisories/rt-sa-2005-008.txt
exploit, vendor-advisory
-
seclists.org
/lists/fulldisclosure/2005/Feb/0343.html
mailing-list, third-party-advisory
Sources
- CVE List CVE-2005-0406
- NVD CVE-2005-0406
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.