CVE-2026-53496
Received Received - Intake

ExifReader ISO-BMFF Parser RangeError DoS via Malicious HEIC/AVIF

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox() and parseBox() accept an eight-byte box header without confirming that fields required by the parsed box remain in the DataView. A valid ftyp box followed by an empty free or unknown box can cause an unchecked full-box version read, while a truncated extended-size box can make getBoxLength() and hasEmptyHighBits() read absent size fields. The resulting RangeError escapes the main parsing path and can abort an application request or worker when parse errors are not defensively caught, causing denial of service. This issue is fixed in version 4.40.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-53496
EUVD
EUVD-2026-77628

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mattiasw exifreader to 4.40.1 (exc)
mattiasw exifreader 4.40.1
mattiasw exifreader From 4.40.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.
CWE-755 The product does not handle or incorrectly handles an exceptional condition.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects ExifReader versions 4.40.0 and below. It involves improper handling of malformed or truncated ISO-BMFF boxes in HEIC or AVIF image files. The parser assumes all boxes have sufficient data but fails to validate box fields, leading to RangeError exceptions. These errors can crash applications or workers when not caught, causing denial of service.

Detection Guidance

This vulnerability is specific to the ExifReader library and requires checking if your application uses vulnerable versions (4.40.0 or below) of ExifReader. Inspect your project's package.json or dependency files for ExifReader versions. No direct network or system commands detect this issue as it involves parsing malformed image files.

Impact Analysis

An attacker could craft a malicious HEIC or AVIF image file that triggers an uncaught exception in ExifReader. If your application processes such files without defensive error handling, it may crash, leading to denial of service. This affects applications using ExifReader to parse images from untrusted sources.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by crashing applications or workers when processing malformed HEIC or AVIF files. It does not directly expose or leak sensitive data, but prolonged service disruptions could impact compliance with availability requirements in standards like GDPR (Article 32) or HIPAA (Security Rule). Organizations processing such files in regulated environments may face audit or operational risks if services become unavailable due to unpatched systems.

Mitigation Strategies

Upgrade ExifReader to version 4.40.1 or later. If using a package manager, run commands like npm update exifreader or yarn upgrade exifreader. Additionally, implement defensive try/catch blocks around ExifReader.load() calls to handle parsing errors gracefully and prevent application crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53496. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart