CVE-2026-8813: ExifReader DoS Via Crafted ICC mluc Tags

The National Vulnerability Database has disclosed CVE-2026-8813, a high-severity denial-of-service vulnerability affecting versions of the exifreader package prior to 4.39.0. This flaw stems from improper handling of crafted images containing an ICC mluc tag. An attacker can manipulate this tag to specify an attacker-controlled record count with a zero record size.

During parsing, ExifReader’s vulnerability lies in its repeated processing of the same record and appending entries to an array without adequate bounds validation. This leads to excessive memory growth, causing memory exhaustion and ultimately a denial-of-service condition in applications that process attacker-supplied images. The National Vulnerability Database assigns this a CVSS score of 7.5 (High), with an AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector, highlighting its network-exploitable nature without requiring user interaction or privileges.

For defenders, this is a critical reminder about third-party library dependencies. Image parsing libraries are often integrated into web applications, content management systems, and backend services that handle user-uploaded content. An attacker’s calculus here is simple: if they can force a service to crash by merely uploading a malicious image, they’ve achieved a low-effort DoS, potentially impacting business continuity or serving as a precursor to more complex attacks. Patching is non-negotiable.