EUVD-2026-77112
GHSA-5vpc-p5mg-f7rm
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Local file delivery required; high complexity for precise SubjectArea tag crafting; availability-only impact with no confirmed confidentiality leak path per library API.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length.
AnalysisAI
Heap-based buffer over-read in TinyEXIF before 1.1.0 allows an attacker who can supply a crafted JPEG image to crash applications that use the library for EXIF metadata parsing. EntryParser::Fetch methods compute SubjectArea IFD entry offsets without validating them against the actual buffer length, producing out-of-bounds reads when processing malformed tags. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target application embeds TinyEXIF at a version prior to 1.1.0; (2) the attacker can introduce a crafted JPEG image into the application's image-processing path - AV:L per CVSS means file delivery to the parser is the prerequisite, not a direct inbound network connection; and (3) the crafted image contains a SubjectArea EXIF tag whose length pushes computed Fetch offsets past the buffer boundary, satisfying the AC:H constraint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 2.9 (Low) with vector AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L accurately reflects the constrained threat model: exploitation requires local delivery of a crafted image into the parsing path of an application using TinyEXIF, and high attack complexity accounts for the need to craft a SubjectArea length value that lands past the buffer boundary without immediately triggering earlier guards. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade TinyEXIF to version 1.1.0 or later, which adds the required bounds checks in EntryParser::Fetch before parse16 and parseRational buffer accesses; the fix is available at https://github.com/cdcseacave/TinyEXIF/pull/25 and documented in the security advisory at https://github.com/cdcseacave/TinyEXIF/security/advisories/GHSA-jqj2-8c2j-gx82. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today