CVE-2026-85715
HighCVSS 7.5Summary
ExifReader before version 4.41.1, when parsing attacker-controlled HEIC or AVIF ISO-BMFF files, trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop iteration. When offsetSize, lengthSize, baseOffsetSize, and indexSize are zero, the extent fields consume no input bytes and the buffer offset does not advance, so the parser can allocate up to itemCount multiplied by extentCount objects without an allocation budget, causing heap growth or memory exhaustion and terminating a Node.js process.
Risk Assessment
A malicious image can cause hundreds of megabytes of heap growth and crash a Node.js application, resulting in denial of service for web, desktop, or mobile applications parsing untrusted images.
Recommendation
Upgrade ExifReader to version 4.41.1, which bounds the work performed during parsing rather than relying on offset advancement.
Other vulnerabilities in ExifReader
See all- CVE-2026-53496Medium
ExifReader before version 4.40.1 has a vulnerability in the ISO-BMFF parser where findMetaBox() and parseBox() do not confirm that required fields remain in the DataView. Specially crafted HEIC or AVIF data can lead to an unchecked full-box version read or reading absent size fields, causing a RangeError that can abort an application request or worker.
- CVE-2026-8814Medium
The exifreader package before version 4.39.0 is vulnerable to Improper Handling of Highly Compressed Data due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size. When asynchronous parsing is enabled, a crafted PNG file can cause ExifReader to materialize a disproportionately large Comment value in memory.
- CVE-2026-8813High
This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends entries to an array without sufficient bounds validation, causing excessive memory growth. In applications that parse attacker-supplied images, this may lead to denial of service through memory exhaustion.
Original NVD description (English source)
ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems() within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop iteration. When offsetSize, lengthSize, baseOffsetSize, and indexSize are zero, the extent fields consume no input bytes and the buffer offset does not advance, but the parser can still allocate up to itemCount multiplied by extentCount objects without an allocation budget. A small malicious iloc box can therefore cause hundreds of megabytes of heap growth or exhaust system memory, terminating a Node.js process and denying service to web, desktop, or mobile applications that parse untrusted images. The zero field widths are valid ISO-BMFF values indicating absent fields, so the vulnerable parser must bound work rather than relying on offset advancement. The issue is fixed in version 4.41.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS