Description

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox() and parseBox() accept an eight-byte box header without confirming that fields required by the parsed box remain in the DataView. A valid ftyp box followed by an empty free or unknown box can cause an unchecked full-box version read, while a truncated extended-size box can make getBoxLength() and hasEmptyHighBits() read absent size fields. The resulting RangeError escapes the main parsing path and can abort an application request or worker when parse errors are not defensively caught, causing denial of service. This issue is fixed in version 4.40.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-14T17:17:46.213Z",
  "pubdate": "2026-09-14T17:17:46.213Z",
  "executiveSummary": "ExifReader, a JavaScript Exif metadata parser, is susceptible to a denial-of-service vulnerability due to improper boundary checking in its ISO-BMFF parsing logic. Affected versions prior to 4.40.1 fail to validate the existence of required box data fields within the DataView when processing HEIC or AVIF image formats.\nThe vulnerability allows an unauthenticated attacker to supply a maliciously crafted image file containing truncated or specifically malformed ISO-BMFF structures. When ExifReader attempts to parse these structures, the lack of input bounds validation triggers an unhandled RangeError exception. This exception propagates outside the intended error-handling path, causing the application request or web worker responsible for the parsing to crash.\nThe impact is primarily a denial of service, where the parsing process is terminated prematurely, rendering the application unable to process further requests or metadata. The vulnerability exists within the logic tasked with navigating complex file headers, specifically affecting the handling of 'ftyp', 'free', and extended-size boxes. Given that ExifReader is widely utilized in web environments, this vulnerability poses a risk to service availability if image processing is exposed to untrusted user input.",
  "technicalDetails": "The vulnerability resides in the src/image-header-iso-bmff.js component of ExifReader, specifically within the findMetaBox() and parseBox() functions. The core issue involves the unsafe deserialization of the ISO-BMFF (ISO Base Media File Format) structure, where the parser fails to conduct sufficient bounds checking against the DataView buffer before reading box headers and associated fields.\nThe attack flow begins when an attacker provides a crafted HEIC or AVIF file to ExifReader.load() or the asynchronous file/URL loaders. The parser initiates the identification of boxes by reading an eight-byte box header. The vulnerability is triggered in two primary scenarios: First, when a valid 'ftyp' box is followed by an empty or 'free' box, the parser attempts an unchecked read of a full-box version, assuming the data exists within the buffer. Second, if a truncated extended-size box is encountered, the internal functions getBoxLength() and hasEmptyHighBits() attempt to access size fields that are not present in the provided buffer.\nBecause these functions do not verify if the expected offsets fall within the bounds of the DataView, the JavaScript engine throws a RangeError. Crucially, this error occurs outside of the standard try-catch blocks designed for graceful error recovery in the parsing path. Consequently, the exception remains unhandled, leading to the immediate termination of the execution thread or web worker currently processing the image. Since ExifReader is often executed in environments where synchronous processing might affect the main event loop or workers are used for background tasking, this crash results in a localized or system-wide denial of service.\nThe vulnerability affects all ExifReader versions prior to 4.40.1. Exploitation does not require authentication or elevated privileges, as it only necessitates that an application process a file controlled by the attacker. By carefully crafting the box offsets and lengths, an attacker can reliably cause the parser to attempt an out-of-bounds read, forcing the application to crash upon encountering these non-conformant structures."
}