Skip to content
Fencer Vulns
medium 4.7

CVE-2021-32617 json

Denial of service in Exiv2

published 2021-05-17 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-19455

cvss
4.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An inefficient algorithm (quadratic complexity) was found in Exiv2 versions v0.27.3 and earlier. The inefficient algorithm is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4. Note that this bug is only triggered when _writing_ the metadata, which is a less frequently used Exiv2 operation than _reading_ the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `rm`.

Patch / fix

  • exiv2 exiv2 0.27.4
  • exiv2 Debian 14, Debian 13, Debian 12 0.27.5-1

debian advisories DEBIAN-CVE-2021-32617

  • exiv2 Ubuntu 18.04 LTS 0.25-3.1ubuntu0.18.04.9
  • exiv2 Ubuntu 20.04 LTS 0.27.2-8ubuntu2.4
  • exiv2 Ubuntu Pro 16.04 LTS 0.25-2.1ubuntu16.04.7+esm2

ubuntu advisories UBUNTU-CVE-2021-32617

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • exiv2 RHEL 8 0.27.4-5.el8
  • exiv2-libs RHEL 8 0.27.4-5.el8

red hat advisories RHSA-2021:4173

  • exiv2 SLE Module for Desktop Applications 15 SP4, openSUSE Leap 15.4 0.27.5-150400.15.4.1
  • exiv2-0_26 SLE Module for Desktop Applications 15 SP4, openSUSE Leap 15.4 0.26-150400.9.16.1
  • exiv2 SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +20 more 0.26-150000.6.16.1
  • exiv2 SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 0.23-12.11.1

suse advisories SUSE-SU-2022:3889-1SUSE-SU-2022:3598-1SUSE-SU-2022:3543-1

  • exiv2 openSUSE Tumbleweed 0.27.5-3.1

opensuse advisories openSUSE-SU-2024:12381-1

  • exiv2 AlmaLinux 8 0.27.4-5.el8
  • exiv2-libs AlmaLinux 8 0.27.4-5.el8

almalinux advisories ALSA-2021:4173

  • exiv2 Rocky Linux 8 0.27.4-5.el8

rocky linux advisories RLSA-2021:4173

  • exiv2 Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 0.27.3-r2

alpine advisories ALPINE-CVE-2021-32617

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • exiv2 CBL-Mariner 2.0 0.27.5-1

azure linux advisories AZL-7213

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • exiv2 Arch Linux 0.27.4-1

arch linux advisories AVG-1772

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-32617 updated cvss 6.2

exiv2: DoS due to quadratic complexity in ProcessUTF8Portion

  • Red Hat Enterprise Linux 6 exiv2, exiv2-libs Red Hat Enterprise Linux 7 exiv2, exiv2-libs, compat-exiv2-023, compat-exiv2-026
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 compat-exiv2-026
    affected: no fix available “Fix deferred”
  • Red Hat CodeReady Linux Builder (v. 8) exiv2-doc 0.27.4-5.el8, exiv2-devel 0.27.4-5.el8, exiv2-debuginfo 0.27.4-5.el8, exiv2-debugsource 0.27.4-5.el8, exiv2-libs-debuginfo 0.27.4-5.el8 Red Hat Enterprise Linux AppStream (v. 8) exiv2 0.27.4-5.el8, exiv2-libs 0.27.4-5.el8
    fixed: vendor fix RHSA-2021:4173
  • Red Hat Enterprise Linux 9 exiv2, exiv2-libs
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.17% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected products

  • Exiv2 exiv2

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.