CVE-2025-32025

Name of the Vulnerable Software and Affected Versions: bep/imagemeta versions prior to 0.11.0

Description: The issue concerns a Go library for reading image metadata from various file formats, including JPEG, TIFF, PNG, and WebP. A buffer created for parsing metadata in PNG and WebP images had no upper bound, potentially leading to large memory allocation. This could be exploited for denial-of-service attacks if the input images were not trusted.

Recommendations: For versions prior to 0.11.0, update to version 0.11.0 or later, which adds a 10 MB upper limit to prevent excessive memory allocation.