{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/exifreader--4.41.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:exifreader_project:exifreader:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-85715"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["exifreader (\u003c= 4.41.0)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","memory-exhaustion"],"_cs_type":"advisory","_cs_vendors":["exifreader"],"content_html":"\u003cp\u003eExifReader 4.41.0 contains a vulnerability in its ISO-BMFF container parsing logic that can be leveraged to cause a denial-of-service (DoS) condition. The vulnerability resides within the \u003ccode\u003egetItems()\u003c/code\u003e function of \u003ccode\u003esrc/image-header-iso-bmff-iloc.js\u003c/code\u003e. Specifically, when parsing the \u003ccode\u003eiloc\u003c/code\u003e (Item Location) box of HEIC or AVIF image files, the library reads configuration fields (\u003ccode\u003eoffsetSize\u003c/code\u003e, \u003ccode\u003elengthSize\u003c/code\u003e, \u003ccode\u003ebaseOffsetSize\u003c/code\u003e, and \u003ccode\u003eindexSize\u003c/code\u003e) which control how the parser iterates through data extents.\u003c/p\u003e\n\u003cp\u003eWhen an attacker provides a crafted file where these size fields are set to zero, the library's extent-parsing loop fails to advance the buffer offset while simultaneously pushing new objects onto the \u003ccode\u003eitem.extents\u003c/code\u003e array for every iteration defined by the \u003ccode\u003eitemCount\u003c/code\u003e and \u003ccode\u003eextentCount\u003c/code\u003e headers. This leads to unbounded memory consumption. A malicious file as small as 652 bytes can trigger 400MB of heap growth, while files in the kilobyte range result in an out-of-memory (OOM) crash, effectively terminating the Node.js process. This poses a significant risk to any service or application utilizing this library for processing user-provided imagery.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious HEIC/AVIF file container following the ISO-BMFF specification.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eiloc\u003c/code\u003e box is populated with an \u003ccode\u003eitemCount\u003c/code\u003e and \u003ccode\u003eextentCount\u003c/code\u003e set to the maximum allowed values (up to 65535 each).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eoffsetSize\u003c/code\u003e, \u003ccode\u003elengthSize\u003c/code\u003e, and \u003ccode\u003ebaseOffsetSize\u003c/code\u003e fields in the \u003ccode\u003eiloc\u003c/code\u003e header are set to zero, signaling that these values are absent in the byte stream.\u003c/li\u003e\n\u003cli\u003eThe victim application receives the malicious image and passes the buffer to \u003ccode\u003eExifReader.load()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe library's \u003ccode\u003egetItems()\u003c/code\u003e function initiates a nested loop, iterating based on the attacker-controlled \u003ccode\u003eitemCount\u003c/code\u003e and \u003ccode\u003eextentCount\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eWithin the loop, the parser performs unconditional object allocations for each extent without advancing the buffer offset.\u003c/li\u003e\n\u003cli\u003eThe heap usage of the Node.js process expands rapidly until it reaches the memory limit defined by the environment.\u003c/li\u003e\n\u003cli\u003eThe process crashes with a JavaScript heap out-of-memory error, resulting in a successful denial-of-service against the host application.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in an immediate denial-of-service for the application process. This vulnerability affects any service (such as web servers, backend media processors, or mobile app backends) that accepts and processes HEIC or AVIF images using ExifReader 4.41.0. Given that a crash-inducing payload is less than 2KB, this is highly effective against internet-facing services, potentially causing significant downtime or resource contention across shared infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to a patched version of ExifReader once available.\u003c/li\u003e\n\u003cli\u003eImplement a per-item or global extent allocation limit in \u003ccode\u003esrc/image-header-iso-bmff-iloc.js\u003c/code\u003e to bound the memory growth.\u003c/li\u003e\n\u003cli\u003eApply an input validation gate to skip the extent parsing loop if \u003ccode\u003eoffsetSize\u003c/code\u003e, \u003ccode\u003elengthSize\u003c/code\u003e, and \u003ccode\u003ebaseOffsetSize\u003c/code\u003e are all zero, as per the suggested fix in the advisory.\u003c/li\u003e\n\u003cli\u003eImplement memory resource monitoring and limits for Node.js worker processes that handle image parsing to mitigate potential OOM crashes.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-17T19:14:14Z","date_published":"2026-09-17T19:14:14Z","id":"https://feed.craftedsignal.io/briefs/2026-09-exifreader-dos/","summary":"ExifReader version 4.41.0 is susceptible to a heap exhaustion denial-of-service vulnerability due to an unbounded object allocation loop when parsing malicious ISO-BMFF iloc box structures.","title":"ExifReader Denial of Service via Crafted HEIC/AVIF Files","url":"https://feed.craftedsignal.io/briefs/2026-09-exifreader-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Exifreader (\u003c= 4.41.0)","version":"https://jsonfeed.org/version/1.1"}