Description
ExifReader 4.41.0 is vulnerable to denial of service through a crafted HEIC or AVIF file with a malicious iloc box. When offsetSize, lengthSize, and baseOffsetSize are set to zero in the iloc header, the extent-parsing loop allocates an unbounded number of JavaScript objects - up to itemCount × extentCount (65535 × 65535 = 4.
Recommendation
Update the exifreader package to the latest compatible version. Followings are version details:
- Affected version(s): <= 4.41.0
- Patched version(s): 4.41.1
References
Could your website be exposed too?
SmartScanner can check your website for ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization - CVE-2026-104845
- Cube Core is vulnerable to Denial of Service (DoS) via crafted request - CVE-2026-25957
- ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes - CVE-2026-53496
- ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag - CVE-2026-8813
You might also like:
See something that needs correcting? Let us knowUpdated September 17, 2026