PT-2026-41831 · Npm · Exifreader

Yuki Matsuhashi · Published 2026-05-19 · Updated 2026-05-29 · CVE-2026-8813

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions exifreader versions prior to 4.39.0

Description A crafted image containing an ICC mluc tag can specify an attacker-controlled record count combined with a zero record size. During the parsing process, the software repeatedly processes the same record and appends entries to an array without sufficient bounds validation, leading to excessive memory growth. This can result in a denial of service through memory exhaustion in applications that parse images supplied by attackers.

Recommendations Update to version 4.39.0 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2026-8813

GHSA-H64W-W9PR-82M4

Affected Products

Exifreader

References · 11

• 🔥 https://security.snyk.io/vuln/SNYK-JS-EXIFREADER-16689335 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8813 · Security Note
• https://osv.dev/vulnerability/GHSA-h64w-w9pr-82m4 · Vendor Advisory
• https://github.com/mattiasw/ExifReader/commit/c9d88b67e127b2dcc7b46e328df468257fb2dc30 · Note
• https://github.com/mattiasw/ExifReader/security/advisories/GHSA-h64w-w9pr-82m4 · Note
• https://github.com/mattiasw/ExifReader · Note
• https://twitter.com/VulmonFeeds/status/2056643037158076702 · Twitter Post
• https://t.me/CVEtracker/54203 · Telegram Post
• https://twitter.com/CVEnew/status/2056670088892486098 · Twitter Post
• https://t.me/cveNotify/163982 · Telegram Post
• https://gist.github.com/yuki-matsuhashi/3243ea38e5fbf8cfe19b624f04c9f4b4 · Note