{"items":[{"id":"NVI-00013995","kind":"vulnerability","title":"ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-pj96-35fp-cfcc","CVE-2026-85715"],"plain_summary":"GitHub lists this reviewed advisory for exifreader. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2ebf87aa0d7746a67f157947a1a47ace"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-17T16:30:01.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-2ebf87aa0d7746a67f157947a1a47ace"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2ebf87aa0d7746a67f157947a1a47ace","url":"https://github.com/advisories/GHSA-pj96-35fp-cfcc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-pj96-35fp-cfcc","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T19:09:30.244Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2ebf87aa0d7746a67f157947a1a47ace"],"technology":"exifreader","known_exclusions":[],"conditions_summary":"## Summary\nExifReader 4.41.0 is vulnerable to denial of service through a crafted HEIC or AVIF file with a malicious `iloc` box. When `offsetSize`, `lengthSize`, and `baseOffsetSize` are set to zero in the iloc header, the extent-parsing loop allocates an unbounded number of JavaScript objects - up to `itemCount × extentCount` (65535 × 65535 = 4.3 billion) - without advancing the buffer offset. A 652-byte file causes 400MB of heap growth; a 6KB file exhausts all system memory and crashes the Node.js process with a JavaScript heap out-of-memory error.\n\n## Affected version tested\n\n- npm package: `exifreader`\n- Version: `4.41.0`\n- Affected formats: HEIC, AVIF (ISO-BMFF container)\n\n## Root cause\n\n**File:** `src/image-header-iso-bmff-iloc.js`, lines 79–116, function `getItems()`.\n\nThe iloc parser reads four size fields from the file (each a 4-bit nibble, valid values 0–15):\n\n| Field | Controls |\n|-------|----------|\n| `offsetSize` | Bytes per extent offset |\n| `lengthSize` | Bytes per extent length |\n| `baseOffsetSize` | Bytes per item base offset |\n| `indexSize` | Bytes per extent index |\n\nThe code then enters a nested loop: for each item (up to 65535), and for each extent within that ","public_affected_ranges":["<= 4.41.0"]}],"null_published_at":"2026-11-02T10:00:37.195Z","source_updated_at":"2026-09-17T16:30:01.000Z","source_disclosed_at":"2026-09-17T16:30:00.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T19:09:30.244Z"}],"next_cursor":null,"snapshot_revision":"42594"}