CVE-2026-53496: CWE-248: Uncaught Exception in mattiasw ExifReader
ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox() and parseBox() accept an eight-byte box header without confirming that fields required by the parsed box remain in the DataView. A valid ftyp box followed by an empty free or unknown box can cause an unchecked full-box version read, while a truncated extended-size box can make getBoxLength() and hasEmptyHighBits() read absent size fields. The resulting RangeError escapes the main parsing path and can abort an application request or worker when parse errors are not defensively caught, causing denial of service. This issue is fixed in version 4.40.1.
AI Analysis
Technical Summary
ExifReader is a JavaScript library for parsing Exif metadata. Versions before 4.40.1 have a vulnerability in the ISO-BMFF parser used for HEIC and AVIF image formats. Specifically, the functions findMetaBox() and parseBox() accept an eight-byte box header without verifying that the required fields remain within the DataView buffer. This can lead to unchecked reads of box version fields or size fields when encountering valid ftyp boxes followed by empty or unknown boxes, or truncated extended-size boxes. Such malformed input triggers a RangeError exception that escapes the main parsing flow, potentially aborting application requests or web workers if exceptions are not caught defensively. This results in a denial of service condition. The vulnerability is addressed in ExifReader version 4.40.1.
Potential Impact
An attacker can supply crafted HEIC or AVIF image data that triggers an uncaught RangeError exception in the ExifReader parser. This exception can abort the processing thread or application request, causing denial of service. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade ExifReader to version 4.40.1 or later, where this issue is fixed. Defensive exception handling around ExifReader parsing can also mitigate the impact by preventing application aborts. Patch status is confirmed fixed in version 4.40.1.
CVE-2026-53496: CWE-248: Uncaught Exception in mattiasw ExifReader
Description
ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox() and parseBox() accept an eight-byte box header without confirming that fields required by the parsed box remain in the DataView. A valid ftyp box followed by an empty free or unknown box can cause an unchecked full-box version read, while a truncated extended-size box can make getBoxLength() and hasEmptyHighBits() read absent size fields. The resulting RangeError escapes the main parsing path and can abort an application request or worker when parse errors are not defensively caught, causing denial of service. This issue is fixed in version 4.40.1.
CVSS v3.1
Score 5.3medium
Affected software
mattiasw
ExifReader
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ExifReader is a JavaScript library for parsing Exif metadata. Versions before 4.40.1 have a vulnerability in the ISO-BMFF parser used for HEIC and AVIF image formats. Specifically, the functions findMetaBox() and parseBox() accept an eight-byte box header without verifying that the required fields remain within the DataView buffer. This can lead to unchecked reads of box version fields or size fields when encountering valid ftyp boxes followed by empty or unknown boxes, or truncated extended-size boxes. Such malformed input triggers a RangeError exception that escapes the main parsing flow, potentially aborting application requests or web workers if exceptions are not caught defensively. This results in a denial of service condition. The vulnerability is addressed in ExifReader version 4.40.1.
Potential Impact
An attacker can supply crafted HEIC or AVIF image data that triggers an uncaught RangeError exception in the ExifReader parser. This exception can abort the processing thread or application request, causing denial of service. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade ExifReader to version 4.40.1 or later, where this issue is fixed. Defensive exception handling around ExifReader parsing can also mitigate the impact by preventing application aborts. Patch status is confirmed fixed in version 4.40.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-09T17:05:25.059Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa81e7d55bf5e2cf54cc389
Added to database: 09/14/2026, 16:19:09 UTC
Last enriched: 09/14/2026, 16:32:35 UTC
Last updated: 09/15/2026, 02:45:26 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.