Vulnerability · Published Jul 8, 2026 · Assigned by CPANSec
CVE-2026-14454Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed
Critical 9.8
In plain English
A critical-severity security flaw in Imager from TONYC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process. An attacker could craft an image with EXIF data that terminates a worker process.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libimager-perl | no fix listed | DEBIAN-CVE-2026-14454 |
| Debian:13 | libimager-perl | no fix listed | DEBIAN-CVE-2026-14454 |
| Debian:14 | libimager-perl | 1.033+dfsg-1 | DEBIAN-CVE-2026-14454 |
| Ubuntu:22.04:LTS | libimager-perl | no fix listed | UBUNTU-CVE-2026-14454 |
| Ubuntu:24.04:LTS | libimager-perl | no fix listed | UBUNTU-CVE-2026-14454 |
| Ubuntu:25.10 | libimager-perl | no fix listed | UBUNTU-CVE-2026-14454 |
| Ubuntu:26.04:LTS | libimager-perl | no fix listed | UBUNTU-CVE-2026-14454 |
| Ubuntu:26.10 | libimager-perl | no fix listed | UBUNTU-CVE-2026-14454 |
Affected products (as reported)
Weakness: CWE-196, CWE-789 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H