Tinyexif
Monthly
Heap-based buffer over-read in TinyEXIF before 1.1.0 allows an attacker who can supply a crafted JPEG image to crash applications that use the library for EXIF metadata parsing. EntryParser::Fetch methods compute SubjectArea IFD entry offsets without validating them against the actual buffer length, producing out-of-bounds reads when processing malformed tags. No public exploit exists and no CISA KEV listing is present; impact is limited to availability and assessed as Low severity.
Heap-based buffer over-read in TinyEXIF before 1.1.0 allows an attacker who can supply a crafted JPEG image to crash applications that use the library for EXIF metadata parsing. EntryParser::Fetch methods compute SubjectArea IFD entry offsets without validating them against the actual buffer length, producing out-of-bounds reads when processing malformed tags. No public exploit exists and no CISA KEV listing is present; impact is limited to availability and assessed as Low severity.