ExifReader vulnerabilities

ExifReader before version 4.41.1, when parsing attacker-controlled HEIC or AVIF ISO-BMFF files, trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop iteration. When offsetSize, lengthSize, baseOffsetSize, and indexSize are zero, the extent fields consume no input bytes and the buffer offset does not advance, so the parser can allocate up to itemCount multiplied by extentCount objects without an allocation budget, causing heap growth or memory exhaustion and terminating a Node.js process.

ExifReader before version 4.40.1 has a vulnerability in the ISO-BMFF parser where findMetaBox() and parseBox() do not confirm that required fields remain in the DataView. Specially crafted HEIC or AVIF data can lead to an unchecked full-box version read or reading absent size fields, causing a RangeError that can abort an application request or worker.

The exifreader package before version 4.39.0 is vulnerable to Improper Handling of Highly Compressed Data due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size. When asynchronous parsing is enabled, a crafted PNG file can cause ExifReader to materialize a disproportionately large Comment value in memory.

This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends entries to an array without sufficient bounds validation, causing excessive memory growth. In applications that parse attacker-supplied images, this may lead to denial of service through memory exhaustion.