exifreader up to 4.38.x ICC mluc Tag improper validation of specified quantity in input

Summaryinfo

A vulnerability identified as problematic has been detected in exifreader up to 4.38.x. Affected is an unknown function of the component ICC mluc Tag Handler. The manipulation leads to improper validation of specified quantity in input. This vulnerability is listed as CVE-2026-8813. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in exifreader up to 4.38.x. This issue affects some unknown functionality of the component ICC mluc Tag Handler. The manipulation with an unknown input leads to a improper validation of specified quantity in input vulnerability. Using CWE to declare the problem leads to CWE-1284. The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. Impacted is availability. The summary by CVE is:

This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends entries to an array without sufficient bounds validation, causing excessive memory growth. In applications that parse attacker-supplied images, this may lead to denial of service through memory exhaustion.

It is possible to read the advisory at security.snyk.io. The identification of this vulnerability is CVE-2026-8813 since 05/18/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 4.39.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-30838). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• exifreader

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14
• 4.15
• 4.16
• 4.17
• 4.18
• 4.19
• 4.20
• 4.21
• 4.22
• 4.23
• 4.24
• 4.25
• 4.26
• 4.27
• 4.28
• 4.29
• 4.30
• 4.31
• 4.32
• 4.33
• 4.34
• 4.35
• 4.36
• 4.37
• 4.38

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion