CVE-2026-85715

Name of the Vulnerable Software and Affected Versions ExifReader versions prior to 4.41.1

Description ExifReader is susceptible to a denial-of-service issue when parsing specially crafted HEIC or AVIF ISO-BMFF files. The problem occurs in the getItems() function within src/image-header-iso-bmff-iloc.js, where the parser trusts the itemCount and extentCount values from the iloc box. When the offsetSize, lengthSize, baseOffsetSize, and indexSize variables are set to zero, the buffer offset does not advance, but the parser continues to allocate extent objects in a nested loop. This can lead to the allocation of up to 4.3 billion objects, causing massive heap growth or exhausting system memory, which terminates the Node.js process. This affects web, desktop, or mobile applications that parse untrusted images.

Recommendations Update ExifReader to version 4.41.1. As a temporary mitigation, restrict the processing of untrusted HEIC or AVIF images until the update is applied.