Back Linuxsecurity

Ubuntu 25.10 Exiv2 Critical Denial of Service Vulnerabilities USN-8103

Linuxsecurity •LinuxSecurity Advisories • March 18, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in Exiv2. Software Description: - exiv2: EXIF/IPTC/XMP metadata manipulation tool Details: It was discovered that Exiv2 did not correctly handle reading certain buffers. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-18771) Wen Cheng discovered that Exiv2 did not correctly handle certain memory allocation. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-18899) It was discovered that Exiv2 did not correctly handle writing certain

The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 exiv2 0.28.5+dfsg-1ubuntu0.1 Ubuntu 24.04 LTS exiv2 0.27.6-1ubuntu0.1 Ubuntu 22.04 LTS exiv2 0.27.5-3ubuntu1.1 Ubuntu 20.04 LTS exiv2 0.27.2-8ubuntu2.7+esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS exiv2 0.25-3.1ubuntu0.18.04.11+esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS exiv2 0.25-2.1ubuntu16.04.7+esm5 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

CVE-2020-18771, CVE-2020-18899, CVE-2025-54080, CVE-2025-55304, CVE-2026-25884, CVE-2026-27596, CVE-2026-27631

CVE-2020-18771, CVE-2020-18899, CVE-2025-54080, CVE-2025-55304,

CVE-2026-25884, CVE-2026-27596, CVE-2026-27631

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Exiv2 Vulnerabilities Affect Multiple Ubuntu Releases Multiple vulnerabilities have been discovered in Exiv2, a metadata manipulation tool, affecting various Ubuntu versions including 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, and 25.10. Notably, CVE-2020-18771 and CVE-2020-18899 could allow attackers to leak sensitive information or cause denial of service by tricking users into opening specially crafted files. Additionally, CVE-2025-54080 and CVE-2025-55304 also pose denial of service risks. The vulnerabilities were reported by Wen Cheng and others, with several CVEs published on 2026-03-02. Users are advised to update their systems to mitigate these risks. The issues primarily affect older and newer LTS versions of Ubuntu, indicating a broad impact across supported systems. The current status is that patches are available for the affected versions. 3 sources 58

Extracted Entities

Ubuntu 25.10 Exiv2 Critical Denial of Service Vulnerabilities USN-8103

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (7)

Platforms (1)