CVE-2022-24614: Metadata-Extractor Project Metadata-Extractor

Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days.

When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use metadata-extractor library.

Affected products

Published 2022-02-24. Last modified 2026-06-17.