The vulnerability in exifreader arises from insufficient bounds validation when parsing the ICC mluc tag in image metadata. An attacker can craft an image with a manipulated record count and zero record size, causing the parser to loop over the same record repeatedly and append data to an array without limit. This results in excessive memory growth and potential denial of service. The issue affects all versions prior to 4.39.0. There is no vendor advisory or patch information available at this time.

Successful exploitation can cause denial of service through memory exhaustion in applications that parse attacker-supplied images using vulnerable versions of exifreader. This could lead to application crashes or system instability. There is no indication of code execution or data corruption beyond resource exhaustion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting or validating image inputs from untrusted sources to reduce exposure. Monitor for updates from the exifreader maintainers regarding patches or official mitigations.