CVE-2026-14454

Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process. An attacker could craft an image with EXIF data that terminates a worker process.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d.patch	Patch
https://metacpan.org/release/TONYC/Imager-1.033/changes	Release Notes
http://www.openwall.com/lists/oss-security/2026/07/08/6	Mailing List Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:tonycoz:imager:*:*:*:*:*:perl:*:*

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Imager anteriores a la 1.033 para Perl tratan los recuentos de entradas IFD EXIF sin signo como con signo. Imager manejó incorrectamente valores grandes de recuento de entradas IFD EXIF, tratándolos como números negativos. Esto podría llevar a un intento de asignar un bloque casi del tamaño del espacio de direcciones, lo que falla y termina el proceso. Un atacante podría crear una imagen con datos EXIF que termine un proceso de trabajador.

Information

Published : 2026-07-08 13:16

Updated : 2026-10-25 21:10

NVD link : CVE-2026-14454

Mitre link : CVE-2026-14454

CVE.ORG link : CVE-2026-14454

JSON object : View

Products Affected

tonycoz

imager

CWE

CWE-196

Unsigned to Signed Conversion Error

CWE-789

Memory Allocation with Excessive Size Value

{"id": "CVE-2026-14454", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14454", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-09T13:50:57.514385Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/tonycoz/imager", "vendor": "TONYC", "product": "Imager", "versions": [{"status": "affected", "version": "0", "lessThan": "1.033", "versionType": "custom"}], "packageName": "Imager", "programFiles": ["imexif.c"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "tiff_load_ifd"}]}]}], "published": "2026-07-08T13:16:30.053", "references": [{"url": "https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d.patch", "tags": ["Patch"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/TONYC/Imager-1.033/changes", "tags": ["Release Notes"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/08/6", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-196"}, {"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed.\n\nImager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process.\n\nAn attacker could craft an image with EXIF data that terminates a worker process."}, {"lang": "es", "value": "Las versiones de Imager anteriores a la 1.033 para Perl tratan los recuentos de entradas IFD EXIF sin signo como con signo.\n\nImager manej\u00f3 incorrectamente valores grandes de recuento de entradas IFD EXIF, trat\u00e1ndolos como n\u00fameros negativos. Esto podr\u00eda llevar a un intento de asignar un bloque casi del tama\u00f1o del espacio de direcciones, lo que falla y termina el proceso.\n\nUn atacante podr\u00eda crear una imagen con datos EXIF que termine un proceso de trabajador."}], "lastModified": "2026-10-25T21:10:00.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tonycoz:imager:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "7A93C7AC-6CF1-4A7F-A3CC-F4EA72208710", "versionEndExcluding": "1.033"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}