{
  "cve_id": "CVE-2026-8813",
  "package": "exifreader",
  "vulnerability_type": "Denial of Service via memory amplification",
  "cwe_ids": ["CWE-1284", "CWE-789"],
  "reproduced": true,
  "fix_verified": true,
  "verdict": "CONFIRMED",
  "vulnerable_version": "4.38.1",
  "fixed_version": "4.39.0",
  "reproduction_method": "Crafted malicious JPEG with ICC profile containing mluc tag with numRecords=10000000 and recordSize=0",
  "test_results": {
    "vulnerable": {
      "version": "4.38.1",
      "exit_code": 134,
      "duration_ms": 2287,
      "outcome": "OOM_CRASH",
      "details": "Process crashed with 'FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory'"
    },
    "fixed": {
      "version": "4.39.0",
      "exit_code": 0,
      "duration_ms": 3,
      "outcome": "SUCCESS",
      "details": "Completed quickly (3 ms, 1.25 MB delta RSS). Fixed version properly validates mluc tag fields."
    }
  },
  "root_cause_summary": "The mluc tag parser in src/icc-tags.js did not validate numRecords and recordSize against the actual ICC buffer length. A crafted profile with large numRecords and zero recordSize caused an unbounded loop that repeatedly pushed objects to an array, causing catastrophic heap growth.",
  "fix_commit": "c9d88b67e127b2dcc7b46e328df468257fb2dc30",
  "timestamp": "2026-05-22T09:09:56Z"
}