# CVE-2026-85715: ExifReader denial of service via crafted HEIC/AVIF iloc box

Source: https://junglewise.ai/threats/cve-2026-85715-exifreader-denial-of-service-via-crafted-heic-avif-iloc-box  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85715 · Severity: high · CVSS 7.5 · Published 2026-09-17

ExifReader is a JavaScript library used to extract metadata from image files, including HEIC and AVIF formats. A vulnerability in its ISO-BMFF container parsing allows an attacker to craft a malicious image file (as small as 1 KB) that causes the library to allocate billions of JavaScript objects in memory, exhausting the heap and crashing any application using it. Applications processing user-uploaded HEIC/AVIF images are at immediate risk of denial of service.

Technologies: [exifreader (npm)](https://junglewise.ai/threats/technologies/npm-exifreader). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-85715 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85715 being exploited in the wild.

**How severe is CVE-2026-85715?** High severity, with a CVSS score of 7.5, published 17 September 2026.

**Which products and versions are affected?** exifreader (npm) SEMVER:introduced=0,fixed=4.41.1.

**Is there a fix for CVE-2026-85715?** Yes. exifreader (npm): upgrade to 4.41.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85715 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-85715?** Check whether you run exifreader (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- exifreader (npm): upgrade to 4.41.1 or later

  ```sh
  npm install exifreader@4.41.1
  ```


## Technical details

The vulnerability exists in `src/image-header-iso-bmff-iloc.js` (lines 79–116) within the `getItems()` function, which parses the ISO-BMFF `iloc` (item location) box. The parser reads four 4-bit size fields (`offsetSize`, `lengthSize`, `baseOffsetSize`, `indexSize`) that indicate the width of variable-length fields. When these are set to zero (a valid per-spec value meaning "field not present"), the buffer offset advancement inside the nested loop becomes zero. However, the code unconditionally allocates and pushes a new extent object onto `item.extents` for each iteration, up to `itemCount × extentCount` (65535 × 65535 = 4.3 billion objects). With no sanity checks or allocation caps, a 652-byte malformed HEIC/AVIF file can trigger ~6.5 million heap object allocations (401 MB), and slightly larger files cause complete out-of-memory crashes. The vulnerability requires no authentication and can be triggered by any application that parses user-supplied HEIC/AVIF images. A patch is available in v4.41.1.

## Affected products

- mattiasw ExifReader <= 4.41.0

## Identifiers

- CVE-2026-85715
- GHSA-pj96-35fp-cfcc

## Timeline

- 2026-07-18: disclosed: Initial public disclosure on GitHub Advisory Database
- 2026-09-17: advisory: GitHub Advisory published (GHSA-pj96-35fp-cfcc, CVE-2026-85715)
- 2026-09-17: patched: Fix released in v4.41.1

## References

- [https://api.github.com/users/alienkeric](https://api.github.com/users/alienkeric)
- [https://github.com/alienkeric](https://github.com/alienkeric)
- [https://api.github.com/users/alienkeric/gists%7B/gist_id%7D](https://api.github.com/users/alienkeric/gists%7B/gist_id%7D)
- [https://api.github.com/users/alienkeric/repos](https://api.github.com/users/alienkeric/repos)
- [https://avatars.githubusercontent.com/u/102582785?v=4](https://avatars.githubusercontent.com/u/102582785?v=4)
- [https://api.github.com/users/alienkeric/events%7B/privacy%7D](https://api.github.com/users/alienkeric/events%7B/privacy%7D)

## Related threats

- [ExifReader denial of service via uncaught RangeError in ISO-BMFF parser](https://junglewise.ai/threats/cve-2026-53496-exifreader-denial-of-service-via-uncaught-rangeerror-in-iso-bmff)
- [ExifReader data amplification in PNG zTXt metadata decompression](https://junglewise.ai/threats/cve-2026-8814-exifreader-data-amplification-in-png-ztxt-metadata-decompression)
- [ExifReader denial of service via memory exhaustion in ICC mluc tag parsing](https://junglewise.ai/threats/cve-2026-8813-exifreader-denial-of-service-via-memory-exhaustion-in-icc-mluc-tag)