CVE-2026-8813: High severity npm/exifreader vulnerability
Impact
When parsing an image with an embedded ICC profile that contains a crafted multiLocalizedUnicodeType (mluc) tag, ExifReader can be made to allocate memory proportional to attacker-controlled fields in the tag rather than to the actual size of the input. Processing such an image causes excessive memory consumption and can terminate the host process (out-of-memory).
Any application that calls ExifReader.load() on untrusted images, for example, user uploads in a web service, is affected. ICC profiles are carried in JPEG, TIFF, PNG, HEIC, AVIF, JPEG XL, and WebP, so the issue is reachable from any of those formats.
Patches
Fixed in exifreader@4.39.0. Upgrade with:
npm install exifreader@latest
Bower users consume the bundled dist/ files from this repository, and the same fix is committed there.
Workarounds
If upgrading is not immediately possible, configure a custom build that excludes the icc module so that ICC parsing (and therefore this code path) is skipped entirely.
Resources
- Reporter's writeup: https://gist.github.com/yuki-matsuhashi/3243ea38e5fbf8cfe19b624f04c9f4b4 - Patch: https://github.com/mattiasw/ExifReader/commit/c9d88b67e127b2dcc7b46e328df468257fb2dc30
Other sources
This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends entries to an array without sufficient bounds validation, causing excessive memory growth. In applications that parse attacker-supplied images, this may lead to denial of service through memory exhaustion.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/exifreaderto a version that resolves this vulnerability.Fixed in 4.39.0 - Upgrade
Upgrade
exifreaderto a version that resolves this vulnerability.Fixed in 4.39.0 - Configuration
If upgrading is not immediately possible, configure a custom build that excludes the `icc` module so ICC parsing (and the `multiLocalizedUnicodeType`/`mluc` code path) is skipped entirely.
ExifReader (custom build) exclude_icc_module = true
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8813?
The severity of CVE-2026-8813 is classified as critical due to the potential for denial of service through crafted image files.
How do I fix CVE-2026-8813?
To fix CVE-2026-8813, upgrade the exifreader package to version 4.39.0 or later.
What versions of exifreader are affected by CVE-2026-8813?
CVE-2026-8813 affects all versions of exifreader prior to 4.39.0.
What type of attack is associated with CVE-2026-8813?
CVE-2026-8813 is associated with denial of service attacks through crafted images containing ICC mluc tags.
Is user data at risk due to CVE-2026-8813?
CVE-2026-8813 does not directly compromise user data but can cause service interruptions.