CVE-2026-8813
ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag
Description
### Impact When parsing an image with an embedded ICC profile that contains a crafted `multiLocalizedUnicodeType` (`mluc`) tag, ExifReader can be made to allocate memory proportional to attacker-controlled fields in the tag rather than to the actual size of the input. Processing such an image causes excessive memory consumption and can terminate the host process (out-of-memory). Any application that calls `ExifReader.load()` on untrusted images, for example, user uploads in a web service, is affected. ICC profiles are carried in JPEG, TIFF, PNG, HEIC, AVIF, JPEG XL, and WebP, so the issue is reachable from any of those formats. ### Patches Fixed in `exifreader@4.39.0`. Upgrade with: npm install exifreader@latest Bower users consume the bundled `dist/` files from this repository, and the same fix is committed there. ### Workarounds If upgrading is not immediately possible, configure a [custom build](https://github.com/mattiasw/ExifReader#configure-a-custom-build) that excludes the `icc` module so that ICC parsing (and therefore this code path) is skipped entirely. ### Resources - Reporter's writeup: https://gist.github.com/yuki-matsuhashi/3243ea38e5fbf8cfe19b624f04c9f4b4 - Patch: https://github.com/mattiasw/ExifReader/commit/c9d88b67e127b2dcc7b46e328df468257fb2dc30
How to fix CVE-2026-8813
To remediate CVE-2026-8813, upgrade the affected package to a fixed version below.
- —upgrade to 4.39.0 or later
Is CVE-2026-8813 being exploited?
Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 2.10.0, < 4.39.0