CVE-2026-53496
MediumCVSS 5.3Summary
ExifReader before version 4.40.1 has a vulnerability in the ISO-BMFF parser where findMetaBox() and parseBox() do not confirm that required fields remain in the DataView. Specially crafted HEIC or AVIF data can lead to an unchecked full-box version read or reading absent size fields, causing a RangeError that can abort an application request or worker.
Risk Assessment
An attacker can remotely cause a denial of service (DoS) by sending a malicious HEIC/AVIF file, potentially disrupting the application or worker processing Exif data.
Recommendation
Upgrade ExifReader to version 4.40.1 or later, which includes a fix for this vulnerability.
Other vulnerabilities in ExifReader
See all- CVE-2026-8814Medium
The exifreader package before version 4.39.0 is vulnerable to Improper Handling of Highly Compressed Data due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size. When asynchronous parsing is enabled, a crafted PNG file can cause ExifReader to materialize a disproportionately large Comment value in memory.
- CVE-2026-8813High
This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends entries to an array without sufficient bounds validation, causing excessive memory growth. In applications that parse attacker-supplied images, this may lead to denial of service through memory exhaustion.
Original NVD description (English source)
ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox() and parseBox() accept an eight-byte box header without confirming that fields required by the parsed box remain in the DataView. A valid ftyp box followed by an empty free or unknown box can cause an unchecked full-box version read, while a truncated extended-size box can make getBoxLength() and hasEmptyHighBits() read absent size fields. The resulting RangeError escapes the main parsing path and can abort an application request or worker when parse errors are not defensively caught, causing denial of service. This issue is fixed in version 4.40.1.