The vulnerability in exifreader before version 4.39.0 arises from insufficient bounds validation when parsing ICC mluc tags in image metadata. Specifically, a crafted image can specify a record count controlled by an attacker combined with a zero record size. This causes the parser to repeatedly process the same record and append entries to an array without limits, resulting in excessive memory consumption. This flaw can be exploited to cause denial of service in applications that parse untrusted images using exifreader.

Successful exploitation can lead to denial of service via memory exhaustion in applications that parse attacker-supplied images using vulnerable versions of exifreader. There is no indication of privilege escalation, code execution, or data disclosure from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided at this time. Until a patch is available, users should consider avoiding processing untrusted images with affected versions of exifreader or implement other application-level mitigations to limit memory usage during image parsing.