CVE-2026-53496

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox() and parseBox() accept an eight-byte box header without confirming that fields required by the parsed box remain in the DataView. A valid ftyp box followed by an empty free or unknown box can cause an unchecked full-box version read, while a truncated extended-size box can make getBoxLength() and hasEmptyHighBits() read absent size fields. The resulting RangeError escapes the main parsing path and can abort an application request or worker when parse errors are not defensively caught, causing denial of service. This issue is fixed in version 4.40.1.

• CWE-248
• CWE-755

• https://github.com/mattiasw/ExifReader/commit/00878ca9df0e26480dda7a931c888048c9f7be45
• https://github.com/mattiasw/ExifReader/releases/tag/v4.40.1
• https://github.com/mattiasw/ExifReader/security/advisories/GHSA-g77h-45rf-hcx4
• https://github.com/mattiasw/ExifReader/security/advisories/GHSA-g77h-45rf-hcx4

Published

Sep 14, 2026

Last Modified

Sep 14, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53488containerd is an open-source container runtime. In versions …8.8
• CVE-2026-53489containerd is an open-source container runtime. Versions pri…6.5
• CVE-2026-5349A vulnerability was identified in Trendnet TEW-657BRM 1.00.1…8.8
• CVE-2026-53492containerd is an open-source container runtime. In Versions …9.6
• CVE-2026-53493containerd is an open-source container runtime. Prior to ver…6.9
• CVE-2026-53495containerd is an open-source container runtime. Prior to 1.7…6.8
• CVE-2026-53497CrossWatch (CW) is a synchronization engine. Prior to versio…5.3
• CVE-2026-53499FORT Validator is a Resource Public Key Infrastructure (RPKI…7.2
• CVE-2026-5350A security flaw has been discovered in Trendnet TEW-657BRM 1…8.8
• CVE-2026-53500Thumbor is an open-source photo thumbnail service by globo.c…8.2
• CVE-2026-53501Thumbor is an open-source photo thumbnail service by globo.c…8.2
• CVE-2026-53502Thumbor is an open-source photo thumbnail service by globo.c…8.7