Executive brief
ExifReader is a JavaScript library used to extract metadata from image files, including HEIC and AVIF formats. A vulnerability in its ISO-BMFF container parsing allows an attacker to craft a malicious image file (as small as 1 KB) that causes the library to allocate billions of JavaScript objects in memory, exhausting the heap and crashing any application using it. Applications processing user-uploaded HEIC/AVIF images are at immediate risk of denial of service.
Technical details
The vulnerability exists in `src/image-header-iso-bmff-iloc.js` (lines 79–116) within the `getItems()` function, which parses the ISO-BMFF `iloc` (item location) box. The parser reads four 4-bit size fields (`offsetSize`, `lengthSize`, `baseOffsetSize`, `indexSize`) that indicate the width of variable-length fields. When these are set to zero (a valid per-spec value meaning "field not present"), the buffer offset advancement inside the nested loop becomes zero. However, the code unconditionally allocates and pushes a new extent object onto `item.extents` for each iteration, up to `itemCount × extentCount` (65535 × 65535 = 4.3 billion objects). With no sanity checks or allocation caps, a 652-byte malformed HEIC/AVIF file can trigger ~6.5 million heap object allocations (401 MB), and slightly larger files cause complete out-of-memory crashes. The vulnerability requires no authentication and can be triggered by any application that parses user-supplied HEIC/AVIF images. A patch is available in v4.41.1.
Affected products
- mattiasw ExifReader <= 4.41.0
Timeline
- 2026-07-18: disclosed: Initial public disclosure on GitHub Advisory Database
- 2026-09-17: advisory: GitHub Advisory published (GHSA-pj96-35fp-cfcc, CVE-2026-85715)
- 2026-09-17: patched: Fix released in v4.41.1