Exploit for CVE-2025-46087

Feysbuk — HEIF Heist Laboratuvarı 🧪 !platformhttps://img.s...

Infinite loop

Overview exifreader is a Library that parses Exif metadata in images. Affected versions of this package are vulnerable to Infinite loop via a malformed ISO-BMFF iloc box in HEIC/AVIF files, parsed by parseItemLocationBox in src/image-header-iso-bmff-iloc.js. When the declared extentCount field in...

CVE-2026-53496

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox and parseBox accept an eight-byte box header withou...

CVE-2026-53496 ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox and parseBox accept an eight-byte box header withou...

EUVD-2026-77628

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox and parseBox accept an eight-byte box header withou...

CVE-2026-53496

ExifReader (npm package exifreader), a JavaScript Exif metadata parser, is vulnerable to denial of service via crafted HEIC/AVIF files in versions prior to 4.40.1 . The ISO-BMFF parser in src/image-header-iso-bmff.js accepts an 8-byte box header without verifying that required fields remain withi...

CVE-2026-53496 ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox and parseBox accept an eight-byte box header withou...

CVE-2026-53496: Uncaught Exception

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox and parseBox accept an eight-byte box header withou...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write through ImageItem::decodeimage in libheif/image-items/imageitem.cc. An attacker can trigger memory corruption by supplying a malformed HEIC image with mismatched alpha-plane geometry that is decoded and scaled agains...

CVE-2026-47247 libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor WordPress, Sharp/libvips,...

CVE-2026-47247 libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor WordPress, Sharp/libvips,...

CVE-2026-47247

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor WordPress, Sharp/libvips,...

CVE-2026-47247: Exposure of Sensitive Information to an Unauthorized Actor

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor WordPress, Sharp/libvips,...

Uncaught Exception

Overview exifreader is a Library that parses Exif metadata in images. Affected versions of this package are vulnerable to Uncaught Exception through the ExifReader.load. An attacker can cause the application to throw an unhandled exception and terminate the request or worker by submitting a...

NPM: ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

NPM: ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes vulnerability discovered by ? in WordPress Npm exifreader versions = 4.40.0...

GHSA-G77H-45RF-HCX4 ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

Summary ExifReader 4.40.0 can throw an uncaught RangeError: Offset is outside the bounds of the DataView while parsing crafted HEIC/AVIF files. The file only needs a valid leading ftyp box with a HEIC/AVIF major brand followed by a malformed ISO-BMFF box, such as an empty 8-byte free box or a...

ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

Summary ExifReader 4.40.0 can throw an uncaught RangeError: Offset is outside the bounds of the DataView while parsing crafted HEIC/AVIF files. The file only needs a valid leading ftyp box with a HEIC/AVIF major brand followed by a malformed ISO-BMFF box, such as an empty 8-byte free box or a...

CVE-2024-48514

php-heic-to-jpg = 1.0.5 is vulnerable to code injection fixed in 1.0.6. An attacker who can upload heic images is able to execute code on the remote server via the file name. As a result, the CIA is no longer guaranteed. This affects php-heic-to-jpg 1.0.5 and below...

Malicious code in sharp-heic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6db9ffb0551887208262a5445e00bde6f964551601c407e01dfd493ef1b144e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3198 Malicious code in sharp-heic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6db9ffb0551887208262a5445e00bde6f964551601c407e01dfd493ef1b144e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...