ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag

### Impact When parsing an image with an embedded ICC profile that contains a crafted `multiLocalizedUnicodeType` (`mluc`) tag, ExifReader can be made to allocate memory proportional to attacker-controlled fields in the tag rather than to the actual size of the input. Processing such an image causes excessive memory consumption and can terminate the host process (out-of-memory). Any application that calls `ExifReader.load()` on untrusted images, for example, user uploads in a web service, is affected. ICC profiles are carried in JPEG, TIFF, PNG, HEIC, AVIF, JPEG XL, and WebP, so the issue is reachable from any of those formats. ### Patches Fixed in `exifreader@4.39.0`. Upgrade with: npm install exifreader@latest Bower users consume the bundled `dist/` files from this repository, and the same fix is committed there. ### Workarounds If upgrading is not immediately possible, configure a [custom build](https://github.com/mattiasw/ExifReader#configure-a-custom-build) that excludes the `icc` module so that ICC parsing (and therefore this code path) is skipped entirely. ### Resources - Reporter's writeup: https://gist.github.com/yuki-matsuhashi/3243ea38e5fbf8cfe19b624f04c9f4b4 - Patch: https://github.com/mattiasw/ExifReader/commit/c9d88b67e127b2dcc7b46e328df468257fb2dc30 Source Code Location: https://github.com/mattiasw/ExifReader Affected Packages: - npm:exifreader, affected >= 2.10.0, < 4.39.0, patched in 4.39.0 CWEs: - CWE-1284: Improper Validation of Specified Quantity in Input CVSS: - Primary: score 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS_V4: score 7.7, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - CVSS_V3: score 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References: - https://github.com/mattiasw/ExifReader/security/advisories/GHSA-h64w-w9pr-82m4 - https://nvd.nist.gov/vuln/detail/CVE-2026-8813 - https://github.com/mattiasw/ExifReader/commit/c9d88b67e127b2dcc7b46e328df468257fb2dc30 - https://gist.github.com/yuki-matsuhashi/3243ea38e5fbf8cfe19b624f04c9f4b4 - https://security.snyk.io/vuln/SNYK-JS-EXIFREADER-16689335 - https://github.com/advisories/GHSA-h64w-w9pr-82m4