The exifreader package versions prior to 4.39.0 improperly handle highly compressed PNG zTXt metadata by decompressing it without limiting the maximum decompressed output size. When asynchronous parsing is enabled, a maliciously crafted PNG file containing a highly compressed zTXt chunk can cause exifreader to allocate a disproportionately large amount of memory for the Comment value. This behavior constitutes a data amplification vulnerability that could impact application stability or availability due to excessive memory consumption. The vulnerability is identified as CVE-2026-8814 with a CVSS 4.0 base score of 6.9 (medium severity). There is no vendor advisory or patch information available at this time.

The vulnerability can lead to excessive memory consumption when processing crafted PNG files with highly compressed zTXt chunks, potentially causing application instability or denial of service due to resource exhaustion. There is no indication of privilege escalation, code execution, or data disclosure. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling asynchronous parsing of PNG metadata if possible or implement input validation to reject suspiciously large or malformed PNG files containing zTXt chunks. Monitor official exifreader releases for updates addressing this vulnerability.