ExifReader, a JavaScript library for parsing Exif information, has a vulnerability (CVE-2026-85715) in versions before 4.41.1. The vulnerability arises in the getItems() function within src/image-header-iso-bmff-iloc.js when parsing HEIC or AVIF ISO-BMFF files. The parser trusts iloc box fields itemCount and extentCount to allocate extent objects in nested loops. When offsetSize, lengthSize, baseOffsetSize, and indexSize are zero, the parser does not advance the buffer offset but still allocates objects proportional to itemCount multiplied by extentCount without limiting this allocation. This can cause hundreds of megabytes of heap growth or exhaust system memory, terminating Node.js processes and causing denial of service in applications parsing untrusted images. The zero field widths are valid per ISO-BMFF, so the parser must impose bounds rather than rely on offset advancement. The vulnerability is addressed in ExifReader version 4.41.1.

An attacker can craft malicious HEIC or AVIF images that trigger excessive memory allocation in vulnerable ExifReader versions, leading to high memory consumption and potential termination of Node.js processes. This results in denial of service for web, desktop, or mobile applications that parse untrusted images using affected versions of ExifReader. There is no impact on confidentiality or integrity, only availability.

Upgrade ExifReader to version 4.41.1 or later, where this vulnerability is fixed. The fix bounds the memory allocation during parsing to prevent excessive heap growth. No other mitigation is indicated or required.