CVE-2026-85715

creationtimestamp| type| source ---|---|--- 2026-09-17 18:35:27+00:00| published-proof-of-concept| https://github.com/mattiasw/ExifReader/security/advisories/GHSA-pj96-35fp-cfcc...

@activeboxes/piece-image-helper (0.1.0), @activepieces/piece-image-helper (>=0.0.5, <=0.1.17) +24 more potentially affected by CVE-2026-85715 via exifreader (>=4.1.1, <=4.41.0)

exifreader NPM version =4.1.1, =0.0.5, =1.18.1-dev.1638815480459, =1.0.2, =2.2.8, =2.1.11, =1.0.6, =0.5.0, =4.10.0, =1.0.0-beta.141, =1.0.0-beta.143 and more Source cves: CVE-2026-85715 Source advisory: OSV:GHSA-PJ96-35FP-CFCC...

Infinite loop

Overview exifreader is a Library that parses Exif metadata in images. Affected versions of this package are vulnerable to Infinite loop via a malformed ISO-BMFF iloc box in HEIC/AVIF files, parsed by parseItemLocationBox in src/image-header-iso-bmff-iloc.js. When the declared extentCount field in...

@activeboxes/piece-image-helper (0.1.0), @activepieces/piece-image-helper (>=0.0.5, <=0.1.17) +24 more potentially affected by CVE-2026-85715 via exifreader (>=4.1.1, <=4.41.0)

exifreader NPM version =4.1.1, =0.0.5, =1.18.1-dev.1638815480459, =1.0.2, =2.2.8, =2.1.11, =1.0.6, =0.5.0, =4.10.0, =1.0.0-beta.141, =1.0.0-beta.143 and more Source cves: CVE-2026-85715 Source advisory: GHSA-PJ96-35FP-CFCC...

@activeboxes/piece-image-helper (0.1.0), @activepieces/piece-image-helper (>=0.0.5, <=0.1.17) +24 more potentially affected by CVE-2026-85715 via exifreader (>=4.1.1, <=4.41.0)

exifreader NPM version =4.1.1, =0.0.5, =1.18.1-dev.1638815480459, =1.0.2, =2.2.8, =2.1.11, =1.0.6, =0.5.0, =4.10.0, =1.0.0-beta.141, =1.0.0-beta.143 and more Source cves: CVE-2026-85715 Source advisory: SNYK:JS-EXIFREADER-20045986...

ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

Summary ExifReader 4.41.0 is vulnerable to denial of service through a crafted HEIC or AVIF file with a malicious iloc box. When offsetSize, lengthSize, and baseOffsetSize are set to zero in the iloc header, the extent-parsing loop allocates an unbounded number of JavaScript objects - up to...

NPM: ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

Memory Exhaustion vulnerability discovered by ? in WordPress Npm exifreader versions = 4.41.0...

GHSA-PJ96-35FP-CFCC ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

Summary ExifReader 4.41.0 is vulnerable to denial of service through a crafted HEIC or AVIF file with a malicious iloc box. When offsetSize, lengthSize, and baseOffsetSize are set to zero in the iloc header, the extent-parsing loop allocates an unbounded number of JavaScript objects - up to...

CVE-2026-85715

ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop...

CVE-2026-85715

ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop...

CVE-2026-85715 ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop...

EUVD-2026-81897

ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop...

CVE-2026-85715

ExifReader prior to 4.41.1 contains a denial-of-service vulnerability in the parsing of HEIC/AVIF ISO-BMFF files within getItems() in src/image-header-iso-bmff-iloc.js. The parser trusts itemCount and extentCount values from the iloc box; when offsetSize, lengthSize, baseOffsetSize, and indexSize...

CVE-2026-85715 ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop...

@activepieces/piece-image-helper (>=0.1.15, <=0.1.17), @agnocon/piece-image-helper (0.1.20) +12 more potentially affected by CVE-2026-85715 via exifreader (>=4.31.0, <=4.41.0)

exifreader NPM version =4.31.0, =0.1.15, =2.2.8, =2.1.11, =0.5.0, =4.10.0, =1.0.0-beta.141, =0.0.0-unstable.6844005670, =0.0.0-unstable.6844005670, =0.0.0-pre.1, =4.11.0, =3.0.2, =0.0.0-unstable.6844005670, =6.4.11 Source cves: CVE-2026-85715 Source advisory: MEND:CVE-2026-85715...

CVE-2026-85715 ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop...

CVE-2026-85715: Memory Allocation with Excessive Size Value

ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop...

CVE-2026-53496

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox and parseBox accept an eight-byte box header withou...

CVE-2026-53496

ExifReader (npm package exifreader), a JavaScript Exif metadata parser, is vulnerable to denial of service via crafted HEIC/AVIF files in versions prior to 4.40.1 . The ISO-BMFF parser in src/image-header-iso-bmff.js accepts an 8-byte box header without verifying that required fields remain withi...

@activeboxes/piece-image-helper (0.1.0), @activepieces/piece-image-helper (>=0.0.5, <=0.1.15) +68 more potentially affected by CVE-2026-53496 via exifreader (>=2.8.2, <=4.39.1)

exifreader NPM version =2.8.2, =0.0.5, =1.8.0-dev.1617120897319, =1.0.2, =2.2.8, =2.1.11, =1.1.17, =1.0.6, =0.5.0, =0.0.17, =4.10.0, =4.10.2 and more Source cves: CVE-2026-53496 Source advisory: MEND:CVE-2026-53496...