Description
ExifReader 4.40.0 can throw an uncaught RangeError: Offset is outside the bounds of the DataView while parsing crafted HEIC/AVIF files. The file only needs a valid leading ftyp box with a HEIC/AVIF major brand followed by a malformed ISO-BMFF box, such as an empty 8-byte free box or a truncated extended-size box.
Recommendation
Update the exifreader package to the latest compatible version. Followings are version details:
- Affected version(s): <= 4.40.0
- Patched version(s): 4.40.1
References
Could your website be exposed too?
SmartScanner can check your website for ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes and gives you actionable findings to investigate.
Start a free scanRelated Issues
- joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas - CVE-2026-48038
- fast-xml-parser has RangeError DoS Numeric Entities Bug - CVE-2026-25128
- fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026- - CVE-2026-33036
- fast-xml-parser has stack overflow in XMLBuilder with preserveOrder - CVE-2026-27942
You might also like:
See something that needs correcting? Let us knowUpdated July 17, 2026