CVE-2026-14454

Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process. An attacker could craft an image with EXIF data that terminates a worker process.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d.patch	Patch
https://metacpan.org/release/TONYC/Imager-1.033/changes	Release Notes
http://www.openwall.com/lists/oss-security/2026/07/08/6	Mailing List Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:tonycoz:imager:*:*:*:*:*:perl:*:*

History

No history.

Information

Published : 2026-07-08 13:16

Updated : 2026-07-10 15:31

NVD link : CVE-2026-14454

Mitre link : CVE-2026-14454

CVE.ORG link : CVE-2026-14454

JSON object : View

Products Affected

tonycoz

imager

CWE

CWE-196

Unsigned to Signed Conversion Error

CWE-789

Memory Allocation with Excessive Size Value

{"id": "CVE-2026-14454", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14454", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-09T13:50:57.514385Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/tonycoz/imager", "vendor": "TONYC", "product": "Imager", "versions": [{"status": "affected", "version": "0", "lessThan": "1.033", "versionType": "custom"}], "packageName": "Imager", "programFiles": ["imexif.c"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "tiff_load_ifd"}]}]}], "published": "2026-07-08T13:16:30.053", "references": [{"url": "https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d.patch", "tags": ["Patch"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/TONYC/Imager-1.033/changes", "tags": ["Release Notes"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/08/6", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-196"}, {"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed.\n\nImager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process.\n\nAn attacker could craft an image with EXIF data that terminates a worker process."}], "lastModified": "2026-07-10T15:31:22.880", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tonycoz:imager:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "7A93C7AC-6CF1-4A7F-A3CC-F4EA72208710", "versionEndExcluding": "1.033"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}