CVE-2026-8814
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
The exifreader package before version 4.39.0 is vulnerable to Improper Handling of Highly Compressed Data due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size. When asynchronous parsing is enabled, a crafted PNG file can cause ExifReader to materialize a disproportionately large Comment value in memory.
Risk Assessment
The risk includes potential memory exhaustion, leading to denial of service in applications processing images.
Recommendation
It is recommended to update exifreader to version 4.39.0 or later.
Original NVD description (English source)
Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size. When asynchronous parsing is enabled, a crafted PNG file containing a highly compressed zTXt chunk can cause ExifReader to materialize a disproportionately large Comment value in memory.