The vulnerability in exifreader prior to version 4.39.0 arises from insufficient validation of the quantity specified in the ICC mluc tag of an image. An attacker can craft an image with a manipulated record count and zero record size, causing the parser to enter a loop where it repeatedly processes the same record and appends data to an array without proper bounds checks. This results in excessive memory growth, potentially exhausting system memory and causing denial of service in applications that parse such images.

Successful exploitation can lead to denial of service through memory exhaustion in applications that use vulnerable versions of exifreader to parse attacker-supplied images. There is no indication of privilege escalation, code execution, or data leakage from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting or validating image inputs from untrusted sources to reduce exposure.