Please report vulnerabilities privately via GitHub's "Report a vulnerability" button under the "Security and quality" tab.
Repository navigation
Security: mattiasw/ExifReader
Security
SECURITY.md
-
Unbounded ICC text/desc tag decoding enables memory-exhaustion denial of serviceGHSA-wr98-5fqg-jwf3 published
Sep 18, 2026 by mattiaswHigh -
Adjacent process memory returned as Thumbnail.image when loadView() gets a DataView narrower than its bufferGHSA-67g5-g9ch-x4fj published
Sep 10, 2026 by mattiaswModerate -
Uncaught RangeError (DoS) when parsing a JPEG with a truncated SOF or JFIF segmentGHSA-cw75-mh4g-4h2j published
Sep 5, 2026 by mattiaswModerate -
Attacker-declared ICC chunk length drives a Uint8Array allocation in readIcc() before any bounds check against the buffer (WebP, HEIC, AVIF)GHSA-wx94-r5p4-hx2f published
Aug 5, 2026 by mattiaswHigh -
Unsanitized XMP retained in `tags._raw` (DOM XSS if rendered as HTML)GHSA-hhgj-2jxm-r7x6 published
Aug 5, 2026 by mattiaswModerate -
SSRF and local file open via string argument to load()GHSA-mjwm-rcx3-79hc published
Aug 5, 2026 by mattiaswLow -
Unbounded allocation via unvalidated XMP chunk length (DoS)GHSA-q53f-v5gx-7j78 published
Aug 5, 2026 by mattiaswHigh -
DoS via Crafted HEIC/AVIF iloc Box - Memory ExhaustionGHSA-pj96-35fp-cfcc published
Jul 18, 2026 by mattiaswHigh -
ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxesGHSA-g77h-45rf-hcx4 published
Jun 6, 2026 by mattiaswModerate -
ExifReader is vulnerable to denial of service via unbounded decompression of image metadataGHSA-rr89-w3h9-m66j published
May 18, 2026 by mattiaswModerate
Learn more about advisories related to mattiasw/ExifReader in the GitHub Advisory Database