Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a denial-of-service caused by an uncaught RangeError in the ExifReader library when parsing malformed HEIC/AVIF files. The root cause lies in the ISO-BMFF box parser, specifically within the src/image-header-iso-bmff.js file. The parser did not sufficiently validate that the byte buffer (DataView) contained enough data before attempting to read from it.
The analysis of the patch commit 00878ca9df0e26480dda7a931c888048c9f7be45 reveals the exact locations of the vulnerability. The two primary vulnerable functions are getBoxLength and parseBox.
getBoxLength: This function was vulnerable when handling boxes with a 64-bit extended size. It would attempt to read the 8-byte extended size field without first checking if those bytes were actually available in the buffer, leading to an out-of-bounds read on truncated files.
parseBox: This function was vulnerable because it would call getBoxLength and then proceed to read various fields from the box (such as the 'version' byte in a full box) without validating that the buffer was large enough to contain them. It trusted the declared length without verifying it against the actual buffer size.
The patch introduces a new utility function, hasBytes, to perform bounds checks before any DataView read operations in these functions. It also wraps the core parsing logic in parseBox within a try...catch block to prevent any RangeError from propagating up and crashing the application.
The functions findMetaBox and findOffsets are also included as they form the call stack leading to the vulnerable code, as confirmed by the stack trace in the vulnerability report. An exploit would trigger a call sequence through findOffsets -> findMetaBox -> parseBox, where the uncaught exception originates.
parseBoxsrc/image-header-iso-bmff.js
getBoxLengthsrc/image-header-iso-bmff.js
findMetaBoxsrc/image-header-iso-bmff.js
findOffsetssrc/image-header-iso-bmff.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| exifreader | npm | <= 4.40.0 | 4.40.1 |