CVE catalog

CVE-2022-24614

libmetadata-extractor-java: CVE-2022-24614

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.73% · Oct 25, 2026

When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use metadata-extractor library.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibmetadata-extractor-javasid2.11.0-1vulnerable
Debianlibmetadata-extractor-javaforky2.11.0-1vulnerable
Debianlibmetadata-extractor-javatrixie2.11.0-1vulnerable
Debianlibmetadata-extractor-javabookworm2.11.0-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibmetadata-extractor-javasourcesid(unfixed)unimportantNot reportedNot reported
Debianlibmetadata-extractor-javasourceforky(unfixed)unimportantNot reportedNot reported
Debianlibmetadata-extractor-javasourcetrixie(unfixed)unimportantNot reportedNot reported
Debianlibmetadata-extractor-javasourcebookworm(unfixed)unimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libmetadata-extractor-java]Affected
    Details (2)

    • 2.11.0-1 · all · bookworm

      Affected

      dsa · libmetadata-extractor-java · debian · bookworm

    • 2.11.0-1 · all · bookworm

      Affected

      dsa · libmetadata-extractor-java · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX]