ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox() and parseBox() accept an eight-byte box header without confirming that fields required by the parsed box remain in the DataView. A valid ftyp box followed by an empty free or unknown box can cause an unchecked full-box version read, while a truncated extended-size box can make getBoxLength() and hasEmptyHighBits() read absent size fields. The resulting RangeError escapes the main parsing path and can abort an application request or worker when parse errors are not defensively caught, causing denial of service. This issue is fixed in version 4.40.1.

Source published

14 Sep 2026 16:12:43 UTC

Source modified

14 Sep 2026 18:52:04 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox() and parseBox() accept an eight-byte box header without confirming that fields required by the parsed box remain in the DataView. A valid ftyp box followed by an empty free or unknown box can cause an unchecked full-box version read, while a truncated extended-size box can make getBoxLength() and hasEmptyHighBits() read absent size fields. The resulting RangeError escapes the main parsing path and can abort an application request or worker when parse errors are not defensively caught, causing denial of service. This issue is fixed in version 4.40.1.

Source published

Sep 14, 2026, 4:12:43 PM (timezone not stated)

Source modified

Sep 14, 2026, 6:52:04 PM (timezone not stated)

Observed here

11 Nov 2026 13:09:35 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox() and parseBox() accept an eight-byte box header without confirming that fields required by the parsed box remain in the DataView. A valid ftyp box followed by an empty free or unknown box can cause an unchecked full-box version read, while a truncated extended-size box can make getBoxLength() and hasEmptyHighBits() read absent size fields. The resulting RangeError escapes the main parsing path and can abort an application request or worker when parse errors are not defensively caught, causing denial of service. This issue is fixed in version 4.40.1.

Source published

14 Sep 2026 17:17:46 UTC

Source modified

30 Sep 2026 19:38:27 UTC

Observed here

25 Oct 2026 13:17:16 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

## Summary ExifReader 4.40.0 can throw an uncaught `RangeError: Offset is outside the bounds of the DataView` while parsing crafted HEIC/AVIF files. The file only needs a valid leading `ftyp` box with a HEIC/AVIF major brand followed by a malformed ISO-BMFF box, such as an empty 8-byte `free` box or a truncated extended-size box. This is reachable through the public `ExifReader.load()` API for in-memory buffers and through the async file/URL loaders when an application parses attacker-supplied images. In applications that do not wrap every parse in a defensive try/catch, a single uploaded or fetched image can abort the request/worker and cause a denial of service. Credit requested: Yaohui Wang. ## Affected version tested - npm package: `exifreader` - Version: `4.40.0` - Repository commit tested: `8cb0261a26b7d986955fe0a6780f076dcb7902e7` ## Root cause The ISO-BMFF parser assumes that every top-level box with at least an 8-byte header also has enough bytes for the fields required by its parsed form. In `src/image-header-iso-bmff.js`: - `findMetaBox()` calls `parseBox(dataView, offset)` while only checking that `offset + 8 <= dataView.byteLength`. - `parseBox()` calls `getBoxLength()` and then unconditionally reads fields such as the full-box version byte for `meta`/`iloc`/`iinf`/`idat` boxes. - `getBoxLength()` handles `boxLength === 1` by calling `hasEmptyHighBits(dataView, offset)`, which reads `dataView.getUint32(offset + 8)` without first checking that the 64-bit extended size field is present. As a result, syntactically small or truncated boxes after a valid HEIC/AVIF `ftyp` box escape the format-detection catch blocks and throw from the main parsing path. ## Reproduction Run this from the repository root against the committed `dist/exif-reader.js` bundle: ```js const ExifReader = require('./dist/exif-reader.js'); function u32be(n) { return [(n >>> 24) & 255, (n >>> 16) & 255, (n >>> 8) & 255, n & 255]; } function ascii(s) { return Array.from(Buffer.from(s, 'ascii')); } function box(type, content = []) { return [...u32be(8 + content.length), ...ascii(type), ...content]; } for (const brand of ['heic', 'avif']) { for (const badBox of ['free', 'abcd']) { const bytes = Uint8Array.from([ ...box('ftyp', ascii(brand)), ...box(badBox), // 8-byte box header with no content ]); try { ExifReader.load(bytes.buffer); console.log(`${brand}/${badBox}: no throw`); } catch (e) { console.log(`${brand}/${badBox}: ${e.name}: ${e.message}`); console.log(String(e.stack).split('\n').slice(0, 6).join('\n')); } } } ``` Observed output on Node v23.11.0 with ExifReader 4.40.0: ```text heic/free: RangeError: Offset is outside the bounds of the DataView RangeError: Offset is outside the bounds of the DataView at DataView.prototype.getUint8 (<anonymous>) at parseBox (.../dist/exif-reader.js:1:16513) at findMetaBox (.../dist/exif-reader.js:1:19032) at findOffsets (.../dist/exif-reader.js:1:19101) heic/abcd: RangeError: Offset is outside the bounds of the DataView avif/free: RangeError: Offset is outside the bounds of the DataView avif/abcd: RangeError: Offset is outside the bounds of the DataView ``` A second variant triggers the extended-size path: ```js const truncatedExtendedBox = [...u32be(1), ...ascii('free')]; const heic = Uint8Array.from([...box('ftyp', ascii('heic')), ...truncatedExtendedBox]); ExifReader.load(heic.buffer); ``` That throws from `hasEmptyHighBits()` / `getBoxLength()` because the extended-size high/low fields are not present. ## Expected behavior Malformed/truncated metadata boxes should be handled like other malformed metadata in the project: return only the successfully parsed file type/metadata, return no app markers, or throw a controlled project-specific error. A safe JavaScript bounds error should not escape from the parser for an attacker-controlled image container. ## Security impact This is a denial-of-service issue for services that parse user-provided HEIC/AVIF files with ExifReader. A minimal attacker-controlled image buffer can cause an unhandled exception in the parser and abort the surrounding request/worker if the embedding application does not catch every parse error. Suggested severity: Medium. Suggested CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`. ## Suggested fix Add explicit bounds checks before every `DataView` read in the ISO-BMFF box parser, especially: - before reading the 64-bit extended size fields in `getBoxLength()`; - before reading the full-box version byte in `parseBox()`; - before descending into `parseSubBoxes()` when a declared box length exceeds available bytes; - ensure `findMetaBox()` breaks on boxes whose declared length is invalid or not fully present. A regression test should cover `ftyp/heic` and `ftyp/avif` followed by an 8-byte empty `free`/unknown box and by a truncated extended-size box.

Source published

17 Jul 2026 20:19:39 UTC

Source modified

17 Jul 2026 20:41:42 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Publisher rating · MODERATE