CVE-2026-85715 in ExifReader
Summary
by MITRE • 09/17/2026
ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems() within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop iteration. When offsetSize, lengthSize, baseOffsetSize, and indexSize are zero, the extent fields consume no input bytes and the buffer offset does not advance, but the parser can still allocate up to itemCount multiplied by extentCount objects without an allocation budget. A small malicious iloc box can therefore cause hundreds of megabytes of heap growth or exhaust system memory, terminating a Node.js process and denying service to web, desktop, or mobile applications that parse untrusted images. The zero field widths are valid ISO-BMFF values indicating absent fields, so the vulnerable parser must bound work rather than relying on offset advancement. The issue is fixed in version 4.41.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
ExifReader is a widely used JavaScript library designed to parse Exif metadata from image files, supporting various formats including JPEG, PNG, and more recently HEIC and AVIF which rely on the ISO-BMFF container format. The vulnerability identified in versions prior to 4.41.1 resides within the parsing logic for ISO-BMFF files, specifically in the getItems function located in src/image-header-iso-bmff-iloc.js. This component is responsible for interpreting the iloc box, which describes the location of items within an ISO-BMFF file by specifying offsets and lengths of data extents. The core technical flaw stems from a lack of input validation regarding specific field widths defined in the iloc structure: offsetSize, lengthSize, baseOffsetSize, and indexSize. In valid ISO-BMFF specifications, these values can legitimately be set to zero, indicating that the corresponding fields are absent or not present in the binary stream. However, the vulnerable implementation fails to account for this scenario when calculating memory allocation requirements during parsing iterations.
When an attacker crafts a malicious HEIC or AVIF file with an iloc box where all four size fields are explicitly set to zero, the parser enters a nested loop structure that iterates based on itemCount and extentCount values provided in the header. Because the field widths are zero, reading these specific parameters consumes no input bytes from the buffer, causing the internal buffer offset pointer to remain static rather than advancing through the file data. Despite this lack of progress in consuming input, the code proceeds to allocate a new extent object for every iteration of the nested loops without any upper bound or allocation budget check. This creates an unbounded memory consumption scenario where the parser continues allocating heap space indefinitely as long as itemCount and extentCount are non-zero, regardless of whether there is actual data remaining in the file stream to justify such allocations.
The operational impact of this flaw is severe, classified under CWE-789: Memory Allocation with Unrestricted Input Values. The vulnerability allows for a remote denial-of-service attack against any application utilizing ExifReader to process untrusted image inputs. By submitting a small but carefully crafted malicious file, an attacker can trigger hundreds of megabytes or even gigabytes of heap growth in the Node.js runtime environment. This rapid memory exhaustion typically leads to the termination of the Node.js process due out-of-memory errors, effectively denying service to web servers, desktop applications, and mobile backends that rely on this library for image metadata extraction. The attack vector is particularly dangerous because it exploits a valid structural element of the ISO-BMFF standard, making detection by simple format validators difficult without deep semantic analysis of allocation patterns.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1496: Resource Hijacking, specifically through resource exhaustion via memory consumption. The attacker leverages the application's own parsing logic against it to degrade system availability rather than executing arbitrary code or stealing data directly. This type of attack is often part of broader campaigns aimed at disrupting services that handle user-uploaded content, such as social media platforms, image hosting sites, or enterprise document management systems. The lack of a safeguard for unbounded iteration in the presence of zero-width fields represents a critical oversight in defensive parsing strategies, where parsers must always assume input may be malformed and enforce strict limits on resource consumption regardless of structural validity.
Mitigation requires immediate upgrading to ExifReader version 4.41.1 or later, which implements proper bounds checking for memory allocation during the parsing of ISO-BMFF structures. Developers integrating this library should ensure that their dependency management systems are configured to pull secure versions automatically. For organizations unable to upgrade immediately, implementing a proxy layer that validates image metadata before passing it to ExifReader can provide temporary relief, though such workarounds are less reliable than patching the root cause. Security teams should also audit other parsers handling ISO-BMFF or similar binary formats for similar unbounded allocation patterns, particularly in contexts where large itemCount and extentCount values could be manipulated by external actors. Regular security assessments of third-party libraries used for parsing complex binary protocols remain essential to prevent such resource exhaustion vulnerabilities from impacting production environments.