VULNERABILITY INTELLIGENCE
CVE-2026-8813
CVSS score7.5 HIGH
EPSS probability0.52%
CISA KEVNot currently listed
Published2026-05-19
Last modified2026-07-23
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends entries to an array without sufficient bounds validation, causing excessive memory growth. In applications that parse attacker-supplied images, this may lead to denial of service through memory exhaustion.
Weakness classification
- report@snyk.io: CWE-1284
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-1284