CVE-2026-8813

描述

### Impact When parsing an image with an embedded ICC profile that contains a crafted `multiLocalizedUnicodeType` (`mluc`) tag, ExifReader can be made to allocate memory proportional to attacker-controlled fields in the tag rather than to the actual size of the input. Processing such an image causes excessive memory consumption and can terminate the host process (out-of-memory). Any application that calls `ExifReader.load()` on untrusted images, for example, user uploads in a web service, is affected. ICC profiles are carried in JPEG, TIFF, PNG, HEIC, AVIF, JPEG XL, and WebP, so the issue is reachable from any of those formats. ### Patches Fixed in `exifreader@4.39.0`. Upgrade with: npm install exifreader@latest Bower users consume the bundled `dist/` files from this repository, and the same fix is committed there. ### Workarounds If upgrading is not immediately possible, configure a [custom build](https://github.com/mattiasw/ExifReader#configure-a-custom-build) that excludes the `icc` module so that ICC parsing (and therefore this code path) is skipped entirely. ### Resources - Reporter's writeup: https://gist.github.com/yuki-matsuhashi/3243ea38e5fbf8cfe19b624f04c9f4b4 - Patch: https://github.com/mattiasw/ExifReader/commit/c9d88b67e127b2dcc7b46e328df468257fb2dc30

如何修補 CVE-2026-8813

要修補 CVE-2026-8813,請將受影響套件升級到下列已修補版本。

• —升級至 4.39.0 或更新版本

CVE-2026-8813 正在被利用嗎?

低 — EPSS 為 0.5%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 2.10.0, < 4.39.0

CVSS 分數