CVE-2026-14454
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
The vulnerability in the Imager library for Perl before version 1.033 mishandles unsigned EXIF IFD entry counts as signed, potentially leading to an attempt to allocate a huge memory block and process crash. An attacker can exploit this by crafting an image with malicious EXIF data to terminate a worker process.
Risk Assessment
The risk involves the possibility of remotely crashing a worker process (e.g., in an image processing environment), leading to denial of service (DoS) and application disruption.
Recommendation
Immediately update the Imager library to version 1.033 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process. An attacker could craft an image with EXIF data that terminates a worker process.