Is CVE-2026-85715 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85715 being exploited in the wild.

How severe is CVE-2026-85715?

High severity, with a CVSS score of 7.5, published 17 September 2026.

Which products and versions are affected?

exifreader (npm) SEMVER:introduced=0,fixed=4.41.1.

Is there a fix for CVE-2026-85715?

Yes. exifreader (npm): upgrade to 4.41.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85715 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85715?

Check whether you run exifreader (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85715: ExifReader denial of service via crafted HEIC/AVIF iloc box

CVE-2026-85715 · Severity: high · CVSS 7.5 · Published 2026-09-17

ExifReader is a JavaScript library used to extract metadata from image files, including HEIC and AVIF formats. A vulnerability in its ISO-BMFF container parsing allows an attacker to craft a malicious image file (as small as 1 KB) that causes the library to allocate billions of JavaScript objects in memory, exhausting the heap and crashing any application using it. Applications processing user-uploaded HEIC/AVIF images are at immediate risk of denial of service.

Technologies: exifreader (npm). Vendors: npm.

Quick answers

Is CVE-2026-85715 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85715 being exploited in the wild.
How severe is CVE-2026-85715?: High severity, with a CVSS score of 7.5, published 17 September 2026.
Which products and versions are affected?: exifreader (npm) SEMVER:introduced=0,fixed=4.41.1.
Is there a fix for CVE-2026-85715?: Yes. exifreader (npm): upgrade to 4.41.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85715 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85715?: Check whether you run exifreader (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

exifreader (npm): upgrade to 4.41.1 or later
```
npm install exifreader@4.41.1
```

Technical details

The vulnerability exists in `src/image-header-iso-bmff-iloc.js` (lines 79–116) within the `getItems()` function, which parses the ISO-BMFF `iloc` (item location) box. The parser reads four 4-bit size fields (`offsetSize`, `lengthSize`, `baseOffsetSize`, `indexSize`) that indicate the width of variable-length fields. When these are set to zero (a valid per-spec value meaning "field not present"), the buffer offset advancement inside the nested loop becomes zero. However, the code unconditionally allocates and pushes a new extent object onto `item.extents` for each iteration, up to `itemCount × extentCount` (65535 × 65535 = 4.3 billion objects). With no sanity checks or allocation caps, a 652-byte malformed HEIC/AVIF file can trigger ~6.5 million heap object allocations (401 MB), and slightly larger files cause complete out-of-memory crashes. The vulnerability requires no authentication and can be triggered by any application that parses user-supplied HEIC/AVIF images. A patch is available in v4.41.1.

Affected products

mattiasw ExifReader <= 4.41.0

Identifiers

CVE-2026-85715
GHSA-pj96-35fp-cfcc

Timeline

2026-07-18: disclosed: Initial public disclosure on GitHub Advisory Database
2026-09-17: advisory: GitHub Advisory published (GHSA-pj96-35fp-cfcc, CVE-2026-85715)
2026-09-17: patched: Fix released in v4.41.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.