CVE-2026-8814 is a medium severity vulnerability in exifreader versions before 4.39.0 caused by improper handling of highly compressed PNG zTXt metadata. The library decompresses PNG zTXt chunks without enforcing a maximum decompressed size, which can lead to data amplification and excessive memory consumption when asynchronous parsing is enabled. This vulnerability is identified as CWE-409 (Improper Handling of Highly Compressed Data). There is no official fix or patch currently available, and no known exploits have been reported. The vulnerability could allow an attacker to cause a denial-of-service condition by forcing the application to allocate disproportionate memory resources during image metadata parsing.

The vulnerability can cause exifreader to consume excessive memory when processing crafted PNG files with highly compressed zTXt chunks, potentially leading to denial-of-service conditions due to resource exhaustion. There is no indication of privilege escalation, code execution, or data disclosure. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling asynchronous parsing of PNG files or validating and sanitizing input files to prevent processing of maliciously crafted PNG zTXt chunks. Monitor vendor advisories for updates regarding patches or official mitigations.