CVE-2026-8813

The record

This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends entries to an array without sufficient bounds validation, causing excessive memory growth. In applications that parse attacker-supplied images, this may lead to denial of service through memory exhaustion.

Affected packages

Related vulnerabilities

• GHSA-h64w-w9pr-82m4 ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag Same vulnerability
• GHSA-rr89-w3h9-m66j ExifReader is vulnerable to denial of service via unbounded decompression of image… Also affects exifreader
• CVE-2026-8814 Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of… Also affects exifreader
• CVE-2026-105754 vLLM is an inference and serving engine for large language models. CWE-1284
• CVE-2026-103484 IVFFlat index build in pgvector before 0.8.7 allows a database user to write data… CWE-1284
• CVE-2026-75806 Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be… CWE-1284
• CVE-2026-93749 source-map-js through 1.2.1 fails to validate the per-section offset line value in… CWE-1284
• CVE-2026-87962 t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in… CWE-1284