CVE-2026-8813
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends entries to an array without sufficient bounds validation, causing excessive memory growth. In applications that parse attacker-supplied images, this may lead to denial of service through memory exhaustion.
Risk Assessment
The organization is at risk of DoS attacks that can exhaust server memory, causing unavailability of image-processing applications.
Recommendation
Update exifreader to version 4.39.0 or later. If an update is not possible, restrict image processing to trusted sources only.
Other vulnerabilities in exifreader
See all- CVE-2026-85715High
ExifReader before version 4.41.1, when parsing attacker-controlled HEIC or AVIF ISO-BMFF files, trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop iteration. When offsetSize, lengthSize, baseOffsetSize, and indexSize are zero, the extent fields consume no input bytes and the buffer offset does not advance, so the parser can allocate up to itemCount multiplied by extentCount objects without an allocation budget, causing heap growth or memory exhaustion and terminating a Node.js process.
- CVE-2026-53496Medium
ExifReader before version 4.40.1 has a vulnerability in the ISO-BMFF parser where findMetaBox() and parseBox() do not confirm that required fields remain in the DataView. Specially crafted HEIC or AVIF data can lead to an unchecked full-box version read or reading absent size fields, causing a RangeError that can abort an application request or worker.
- CVE-2026-8814Medium
The exifreader package before version 4.39.0 is vulnerable to Improper Handling of Highly Compressed Data due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size. When asynchronous parsing is enabled, a crafted PNG file can cause ExifReader to materialize a disproportionately large Comment value in memory.
Original NVD description (English source)
This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends entries to an array without sufficient bounds validation, causing excessive memory growth. In applications that parse attacker-supplied images, this may lead to denial of service through memory exhaustion.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS