5.5
CVE-2022-24614
- EPSS 0.72%
- Veröffentlicht 24.02.2022 15:15:29
- Zuletzt bearbeitet 12.09.2025 19:46:21
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginWhen reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use metadata-extractor library.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Metadata-extractor Project ≫ Metadata-extractor Version < 2.18.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.72% | 0.489 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.5 | 1.8 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:N/A:P
|
CWE-770 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
https://github.com/drewnoakes/metadata-extractor/issues/561