bep vulnerabilities

Products

• github.com/bep/imagemeta 2

Latest bep CVEs

Newest publication first

1. CVE-2025-32025 bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing

   Published 2025-04-08

   Medium·CVSS 6.9

   bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The buffer created for parsing metadata for PNG and WebP images was only bounded by their input data type, which could lead to potentially large memory allocation, a...

2. CVE-2025-32024 bep/imagemeta allows excessively large EXIF data structures

   Published 2025-04-08

   Medium·CVSS 6.9

   bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The EXIF data format allows for defining excessively large data structures in relatively small payloads. Before v0.10.0, If you didn't trust the input images, this c...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.