PT-2026-41832

CVE-2026-8814

Published

2026-05-19

Updated

2026-10-31

Description by

CVSS 4.0

5.5

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions exifreader versions prior to 4.39.0

Description Improper handling of highly compressed data leads to data amplification when decompressing PNG zTXt metadata without enforcing a maximum decompressed output size. If asynchronous parsing is enabled, a specially crafted PNG file with a highly compressed zTXt chunk can cause the software to materialize an excessively large Comment value in memory.

Recommendations Update to version 4.39.0 or later.

Exploitability

Exploit

Fix

Researchers

Yuki Matsuhashi

Vendors

Affected products

Weakness enumeration

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

Related identifiers

CVE-2026-8814