High
Security advisory
This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends entries to an array without sufficient bounds validation, causing excessive memory growth. In applications that parse attacker-supplied images, this may lead to denial of service through memory exhaustion.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-8813
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 19:33 UTC · Revision 1
Source evidence
This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends entries to an array without sufficient bounds validation, causing excessive memory growth. In applications that parse attacker-supplied images, this may lead to denial of service through memory exhaustion.
osv:CVE-2026-8813
Complete source record
{
"id": "5bd34d585237ddb5690459181a3aaa1b4bd02b1aef3663de72f8a0c631bd7b7b",
"url": "https://osv.dev/vulnerability/CVE-2026-8813",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2026-8813",
"summary": "This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends entries to an array without sufficient bounds validation, causing excessive memory growth. In applications that parse attacker-supplied images, this may lead to denial of service through memory exhaustion.",
"evidence": "osv:CVE-2026-8813",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-8813",
"aliases": [
"CVE-2026-8813",
"GHSA-h64w-w9pr-82m4"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/mattiasw/exifreader",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "fa7815bc95a67771244fa00a068718a52c02ca2e"
},
{
"fixed": "c9d88b67e127b2dcc7b46e328df468257fb2dc30"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "4.39.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "c9d88b67e127b2dcc7b46e328df468257fb2dc30"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v4.38.1",
"v4.38.0",
"v4.37.1",
"v4.37.0",
"v4.36.2",
"v4.36.1",
"v4.36.0",
"v4.35.0",
"v4.34.0",
"v4.33.1",
"v4.33.0",
"v4.32.0",
"v4.31.2",
"v4.31.1",
"v4.31.0",
"v4.30.1",
"v4.30.0",
"v4.29.0",
"v4.28.1",
"v4.28.0",
"v4.27.0",
"v4.26.2",
"v4.26.1",
"v4.26.0",
"v4.25.0",
"v4.24.0",
"v4.23.7",
"v4.23.6",
"v4.23.5",
"v4.23.4",
"v4.23.3",
"v4.23.2",
"v4.23.1",
"v4.23.0",
"v4.22.1",
"v4.22.0",
"v4.21.1",
"v4.21.0",
"v4.20.0",
"v4.19.1",
"v4.19.0",
"v4.18.0",
"v4.16.0",
"v4.15.0",
"v4.14.1",
"v4.14.0",
"4.14.0",
"4.13.2",
"4.13.1",
"v4.13.0",
"4.13.0",
"4.12.1",
"v4.12.0",
"4.12.0",
"v4.11.1",
"4.11.1",
"v4.11.0",
"4.11.0",
"v4.10.0",
"4.10.0",
"v4.9.2",
"4.9.2",
"v4.9.1",
"4.9.1",
"v4.9.0",
"4.9.0",
"v4.8.1",
"4.8.1",
"v4.8.0",
"4.8.0",
"v4.7.0",
"4.7.0",
"v4.6.0",
"4.6.0",
"v4.5.1",
"4.5.1",
"v4.5.0",
"4.5.0",
"v4.4.0",
"4.4.0",
"v4.3.1",
"4.3.1",
"v4.3.0",
"4.3.0",
"v4.2.0",
"4.2.0",
"v4.1.1",
"4.1.1",
"v4.1.0",
"4.1.0",
"v4.0.0",
"4.0.0",
"v3.16.0",
"3.16.0",
"v3.15.0",
"3.15.0",
"v3.14.1",
"3.14.1",
"v3.14.0",
"3.14.0",
"v3.13.0",
"3.13.0",
"v3.12.6",
"3.12.6",
"v3.12.5",
"3.12.5",
"v3.12.4",
"3.12.4",
"v3.12.3",
"3.12.3",
"v3.12.2",
"3.12.2",
"3.12.1",
"v3.12.0",
"3.12.0",
"v3.11.2",
"3.11.2",
"v3.11.1",
"3.11.1",
"v3.11.0",
"3.11.0",
"v3.10.0",
"3.10.0",
"v3.9.0",
"3.9.0",
"v3.8.0",
"3.8.0",
"v3.7.0",
"3.7.0",
"v3.6.1",
"3.6.1",
"3.6.0",
"3.4.0",
"3.3.0",
"3.2.0",
"3.1.0",
"3.0.0",
"2.13.1",
"2.13.0",
"2.12.0",
"2.11.0",
"2.10.0",
"2.9.0",
"2.8.5",
"2.8.4",
"2.8.3",
"2.8.2",
"2.8.1",
"2.7.0",
"2.6.0",
"2.5.0",
"2.4.0",
"2.3.0",
"2.2.0",
"2.1.2",
"2.1.1",
"2.1.0",
"2.0.2",
"v1.1.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8813.json"
}
}
],
"modified": "2026-10-28T02:30:38.756276927Z",
"provider": "osv",
"references": [
"https://gist.github.com/yuki-matsuhashi/3243ea38e5fbf8cfe19b624f04c9f4b4",
"https://security.snyk.io/vuln/SNYK-JS-EXIFREADER-16689335",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8813.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-8813",
"https://github.com/mattiasw/ExifReader/commit/c9d88b67e127b2dcc7b46e328df468257fb2dc30"
],
"provider_metadata": {
"cwe_ids": [
"CWE-1284"
],
"cna_assigner": "snyk",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8813.json"
}
},
"related_cves": [
{
"value": "CVE-2026-8813",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 506216,
"published_at": "2026-05-19T05:00:04.103+00:00"
}