ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag
Impact
When parsing an image with an embedded ICC profile that contains a crafted multiLocalizedUnicodeType (mluc) tag, ExifReader can be made to allocate memory proportional to attacker-controlled fields in the tag rather than to
the actual size of the input. Processing such an image causes excessive memory consumption and can terminate the host process (out-of-memory).
Any application that calls ExifReader.load() on untrusted images, for example, user uploads in a web service, is affected. ICC profiles are carried in JPEG, TIFF, PNG, HEIC, AVIF, JPEG XL, and WebP, so the issue is reachable from any of those formats.
Patches
Fixed in exifreader@4.39.0. Upgrade with:
npm install exifreader@latestBower users consume the bundled dist/ files from this repository, and the same fix is committed there.
Workarounds
If upgrading is not immediately possible, configure a custom build that excludes the icc module so that ICC parsing (and therefore this code path) is skipped entirely.
Resources
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | exifreader | >= 2.10.0, < 4.39.0 | 4.39.0 |
References
- https://github.com/mattiasw/ExifReader/security/advisories/GHSA-h64w-w9pr-82m4
- https://nvd.nist.gov/vuln/detail/CVE-2026-8813
- https://github.com/mattiasw/ExifReader/commit/c9d88b67e127b2dcc7b46e328df468257fb2dc30
- https://github.com/mattiasw/ExifReader
- https://security.snyk.io/vuln/SNYK-JS-EXIFREADER-16689335
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-1284- Platform
- npm
- Package
exifreader- Disclosed
- 29.05.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-h64w-w9pr-82m4 - CC BY 4.0
Vulnerability history: exifreader
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 05.2026 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 2
Disclosures per year
- 2026: 4
-
ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.