{"id":"CVE-2026-14454","aliases":["DEBIAN-CVE-2026-14454","EUVD-2026-42226","GHSA-j48m-64vj-6rm9","MGASA-2026-0284","UBUNTU-CVE-2026-14454"],"status":"published","title":"Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed","description":"Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed.\n\nImager mishandled large EXIF IFD entry count values, treating them as negative numbers.  This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process.\n\nAn attacker could craft an image with EXIF data that terminates a worker process.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00657,"percentile":0.51946,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-196","CWE-789"],"published":"2026-07-08T12:30:20Z","modified":"2026-10-28T11:07:37Z","fixes":[{"ecosystem":"Debian:14","package":"libimager-perl","fixed_in":["1.033+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.019+dfsg-1","1.019+dfsg-2","1.020+dfsg-1","1.022+dfsg-1","1.023+dfsg-1","1.024+dfsg-1","1.024+dfsg-2","1.025+dfsg-1","1.027+dfsg-1","1.028+dfsg-1","1.029+dfsg-1","1.030+dfsg-1","1.031+dfsg-1","1.032+dfsg-1","1.033+dfsg-1","1.034+dfsg-1","1.034+dfsg-2","1.035+dfsg-1","1.036+dfsg-1","1.037+dfsg-1","1.037+dfsg-2","1.040+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.027+dfsg-1","1.028+dfsg-1","1.029+dfsg-1","1.030+dfsg-1","1.031+dfsg-1","1.032+dfsg-1","1.033+dfsg-1","1.034+dfsg-1","1.034+dfsg-2","1.035+dfsg-1","1.036+dfsg-1","1.037+dfsg-1","1.037+dfsg-2","1.040+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.033+dfsg-1"}]}],"versions":["1.027+dfsg-1","1.028+dfsg-1","1.029+dfsg-1","1.030+dfsg-1","1.031+dfsg-1","1.032+dfsg-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Imager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.0-1.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Imager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.0-2.2.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.003+dfsg-1","1.004+dfsg-1","1.004+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.005+dfsg-2build1","1.006+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.011+dfsg-1","1.011+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.012+dfsg-1build1","1.012+dfsg-2","1.012+dfsg-2build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.019+dfsg-2","1.020+dfsg-1","1.022+dfsg-1","1.023+dfsg-1","1.023+dfsg-1build1","1.023+dfsg-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.027+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.029+dfsg-1","1.031+dfsg-1","1.033+dfsg-1","1.035+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.027+dfsg-1","1.029+dfsg-1"]}],"products":[{"vendor":"tonyc","product":"imager"},{"vendor":"tonycoz","product":"imager"}],"references":[{"url":"https://metacpan.org/release/TONYC/Imager-1.033/changes","tags":["release-notes","Release Notes","advisory"]},{"url":"https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d.patch","tags":["patch","Patch","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/08/6","tags":["Mailing List","Patch","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14454","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j48m-64vj-6rm9"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14454.json","tags":["advisory"]},{"url":"https://github.com/tonycoz/imager","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-14454","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0284.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35848","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7QJU7MFFAP73YEH5YEG35EDMGSNOZ3O5/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/08/6","tags":["web"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/41572386/","tags":["web"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/41637674/","tags":["web","report"]},{"url":"https://github.com/briandfoy/cpan-security-advisory/issues/167","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-14454","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14454","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-14454","title":"Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed","description":"Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed.\n\nImager mishandled large EXIF IFD entry count values, treating them as negative numbers.  This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process.\n\nAn attacker could craft an image with EXIF data that terminates a worker process.","status":"published","published":"2026-07-08T12:30:20.23Z","modified":"2026-07-09T14:41:45.096Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-196","CWE-789"],"updated_at":"2026-11-02T13:38:43.260938Z"}],"euvd":[{"id":"EUVD-2026-42226","description":"Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed.\n\nImager mishandled large EXIF IFD entry count values, treating them as negative numbers.  This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process.\n\nAn attacker could craft an image with EXIF data that terminates a worker process.","status":"published","published":"2026-07-08T12:30:20Z","modified":"2026-07-09T14:41:45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:20:04.126011Z"}],"ghsa":[{"id":"GHSA-j48m-64vj-6rm9","title":"Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed.\n\nImager...","description":"Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed.\n\nImager mishandled large EXIF IFD entry count values, treating them as negative numbers.  This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process.\n\nAn attacker could craft an image with EXIF data that terminates a worker process.","status":"published","published":"2026-07-08T15:31:59Z","modified":"2026-07-09T18:32:40Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-196"],"updated_at":"2026-11-02T15:09:22.189239Z"}],"nvd":[{"id":"CVE-2026-14454","description":"Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed.\n\nImager mishandled large EXIF IFD entry count values, treating them as negative numbers.  This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process.\n\nAn attacker could craft an image with EXIF data that terminates a worker process.","status":"published","published":"2026-07-08T13:16:30.053Z","modified":"2026-10-25T21:10:00.77Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-196","CWE-789"],"updated_at":"2026-11-02T14:12:28.040501Z"}],"osv":[{"id":"CVE-2026-14454","title":"Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed","description":"Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed.\n\nImager mishandled large EXIF IFD entry count values, treating them as negative numbers.  This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process.\n\nAn attacker could craft an image with EXIF data that terminates a worker process.","status":"published","published":"2026-07-08T12:30:20.23Z","modified":"2026-10-28T11:07:37.719201051Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-196","CWE-789"],"updated_at":"2026-11-02T15:44:57.354194Z"},{"id":"DEBIAN-CVE-2026-14454","description":"Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed.  Imager mishandled large EXIF IFD entry count values, treating them as negative numbers.  This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process.  An attacker could craft an image with EXIF data that terminates a worker process.","status":"published","published":"2026-07-08T13:16:30.053Z","modified":"2026-10-26T12:02:56.871817667Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:51.8748Z"},{"id":"UBUNTU-CVE-2026-14454","description":"Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers.  This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process. An attacker could craft an image with EXIF data that terminates a worker process.","status":"published","published":"2026-07-08T13:16:00Z","modified":"2026-10-17T12:59:52.813896271Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"MGASA-2026-0284","title":"Updated perl-Imager package fixes security vulnerabilities","description":"The updated package fixes security vulnerabilities:\nThe Imager package before 1.025 for Perl has a heap-based buffer\noverflow leading to denial of service, or possibly unspecified other\nimpact, when the trim() method is called on a crafted input image.\n(CVE-2024-53901)\nImager versions before 1.032 for Perl have a heap out-of-bounds read in\nthe bundled Imager::File::SGI reader via a 16-bit RLE literal run in\nread_rgb_16_rle. (CVE-2026-13705)\nImager::File::JPEG versions before 1.003 for Perl leak heap memory when\nreading a JPEG with repeated APP13 markers in i_readjpeg_wiol.\n(CVE-2026-13708)\nImager versions before 1.033 for Perl treat unsigned EXIF IFD entry\ncounts as signed. (CVE-2026-14454)\n","status":"published","published":"2026-07-20T19:06:32Z","modified":"2026-07-20T19:15:05.272142173Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}