CVE-2026-14454: imager — Fix

Description

Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process. An attacker could craft an image with EXIF data that terminates a worker process.

Is your site exposed to CVE-2026-14454?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0037

Probability of exploitation

0.30%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-196 CWE-196

CWE-789 CWE-789

Affected Products

Vendor	Product	Versions
tonycoz	imager	< 1.033

References

Advisories & Patches

https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d.patch http://www.openwall.com/lists/oss-security/2026/07/08/6

Other References

https://metacpan.org/release/TONYC/Imager-1.033/changes

Frequently Asked Questions

What is CVE-2026-14454? +

Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process. An attacker could craft an image with EXIF data that terminates a worker process. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2026-14454? +

CVE-2026-14454 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately. The EPSS score is 0.0037, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-14454? +

CVE-2026-14454 affects products from tonycoz, specifically: imager. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-14454? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-93019 9.1

Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or …

CVE-2026-58317 6.3

Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera …

CVE-2026-106567 5.9

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted …

CVE-2024-53901 5.5

The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified …

CVE-2026-14454