CVE-2025-54080: 
Python vulnerability analysis and mitigation

CVE-2025-54080 affects Exiv2, a C++ library and command-line utility for reading, writing, deleting, and modifying image metadata. The vulnerability was discovered in versions 0.28.5 and earlier, with the disclosure date being August 29, 2025. The vulnerability affects the metadata writing functionality of the software (GitHub Advisory).

The vulnerability is classified as an out-of-bounds read (CWE-125) that occurs in the Exiv2::EpsImage::writeMetadata() function when processing crafted EPS files. The issue has received a CVSS v4.0 base score of 1.8 (LOW) with the vector string CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. Additionally, it has a CVSS v3.1 base score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a denial of service condition by causing Exiv2 to crash when processing specially crafted image files. The impact is limited to scenarios where the metadata writing functionality is used, which is less common than metadata reading operations (GitHub Advisory).

The vulnerability has been fixed in Exiv2 version 0.28.6. Users are advised to upgrade to this version or later to address the security issue. The fix includes improved bounds checking in the affected code (GitHub Advisory).