ByteOS Network

CVE Vulnerability Details :

CVE-2026-8814

PUBLISHED

More Info Official Page

Assigner-snyk

Assigner Org ID-bae035ff-b466-4ff4-94d0-fc9efd9e1730

Published At-19 May, 2026 | 05:00

Updated At-19 May, 2026 | 05:00

▼CVE Numbering Authority (CNA)

Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size. When asynchronous parsing is enabled, a crafted PNG file containing a highly compressed zTXt chunk can cause ExifReader to materialize a disproportionately large Comment value in memory.

Affected Products

Vendor

n/a

Product

exifreader

Versions

Affected

From 0 before 4.39.0 (semver)

Problem Types

Type	CWE ID	Description
N/A	N/A	Improper Handling of Highly Compressed Data (Data Amplification)

Type: N/A

CWE ID: N/A

Description: Improper Handling of Highly Compressed Data (Data Amplification)

Metrics

Version	Base score	Base severity	Vector
3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P
4.0	6.9	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P

Version: 4.0

Base score: 6.9

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Credits

Yuki Matsuhashi

References

Hyperlink	Resource
https://security.snyk.io/vuln/SNYK-JS-EXIFREADER-16689340	N/A
https://gist.github.com/yuki-matsuhashi/cad1a45d936062438b4ab24613c34c55	N/A
https://github.com/mattiasw/ExifReader/commit/5f116128adc19f674902f8bf582bfe7dd0a36375	N/A

Hyperlink: https://security.snyk.io/vuln/SNYK-JS-EXIFREADER-16689340

Resource: N/A

Hyperlink: https://gist.github.com/yuki-matsuhashi/cad1a45d936062438b4ab24613c34c55

Resource: N/A

Hyperlink: https://github.com/mattiasw/ExifReader/commit/5f116128adc19f674902f8bf582bfe7dd0a36375

Resource: N/A

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References