CVE-2026-53496Medium· 5.3▾ TwilightPoC availableExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where f…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.5%
ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox() and parseBox() accept an eight-byte box header without confirming that fields required by the parsed box remain in the DataView. A valid ftyp box followed by an empty free or unknown box can cause an unchecked full-box version read, while a truncated extended-size box can make getBoxLength() and hasEmptyHighBits() read absent size fields. The resulting RangeError escapes the main parsing path and can abort an application request or worker when parse errors are not defensively caught, causing denial of service. This issue is fixed in version 4.40.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
exifreader <= 4.40.0Patched in:
exifreader 4.40.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85715High· 7.5ExifReader is a JavaScript Exif information parser
CVE-2024-21907High· 7.5Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability
CVE-2026-92954High· 8.6vm2 is a sandbox library for running untrusted JavaScript in Node.js
CVE-2026-61544High· 8.2libp2p-rust is the official Rust language implementation of the libp2p networking stack
CVE-2026-88015Medium· 5.3rclone is a command-line program to sync files and directories to and from different cloud storage providers
CVE-2026-55244Medium· 5.0ASTEVAL is an evaluator of Python expressions and statements