A medium-severity vulnerability identified as CVE-2026-53496 with a CVSS score of 5.3 affects the ExifReader library's HEIC/AVIF ISO-BMFF parser. The flaw allows an attacker to cause a denial-of-service by providing a crafted HEIC/AVIF file that triggers an uncaught RangeError while parsing. This can occur when the application does not wrap every parse operation in a defensive try/catch block, and a single uploaded or fetched image can abort the request or worker process. The vulnerability is reachable through the public ExifReader.load API for in-memory buffers and asynchronous file/URL loaders. A suggested fix involves adding explicit bounds checks before every DataView read in the ISO-BMFF box parser to prevent unhandled exceptions and ensure safe parsing of malformed metadata boxes.
We recommend you to update exifreader to below version: https://github.com/mattiasw/ExifReader/releases[/subscribe_to_unlock_form]
A medium-severity vulnerability identified as CVE-2026-53496 with a CVSS score of 5.3 affects the ExifReader library's HEIC/AVIF ISO-BMFF parser. The flaw allows an attacker to cause a denial-of-service by providing a crafted HEIC/AVIF file that triggers an uncaught RangeError while parsing. This can occur when the application does not wrap every parse operation in a defensive try/catch block, and a single uploaded or fetched image can abort the request or worker process. The vulnerability is reachable through the public ExifReader.load API for in-memory buffers and asynchronous file/URL loaders. A suggested fix involves adding explicit bounds checks before every DataView read in the ISO-BMFF box parser to prevent unhandled exceptions and ensure safe parsing of malformed metadata boxes.
We recommend you to update exifreader to below version: https://github.com/mattiasw/ExifReader/releases[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]