This affects versions of the package exifreader before 4.39.0
The exifreader package has a vulnerability that allows an attacker to craft an image with a malicious ICC mluc tag, causing excessive memory growth and potentially leading to a denial-of-service attack. This issue affects applications that parse attacker-supplied images. Developers should be aware of this issue when working with exifreader.
This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends entries to an array without sufficient bounds validation, causing excessive memory growth. In applications that parse attacker-supplied images, this may lead to denial of service through memory exhaustion.
Developers using the exifreader package are at high risk of a denial-of-service attack, which can cause memory exhaustion and system crashes, especially when parsing attacker-supplied images.
Remediation Recommended
This vulnerability carries significant risk. Schedule patching in your next cycle.
What should I do?
Published
CVE disclosed publicly
Last Modified
Most recent update
Indexed to CVEInsight
Added to this platform
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0
Affected Products
3
References
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability
Impact