CVE-2026-14454: Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed
Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed.
Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process.
An attacker could craft an image with EXIF data that terminates a worker process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Imager (Perl)to a version that resolves this vulnerability.Fixed in 1.033 - Compensating control
Mitigate the impact by restarting/isolating the affected worker process until the Imager upgrade to version 1.033 or later is applied, since the flaw can kill the process during image parsing.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14454?
CVE-2026-14454 has a risk rating of 26.
What vulnerabilities are associated with CVE-2026-14454?
CVE-2026-14454 is associated with the mishandling of unsigned EXIF IFD entry counts in Imager versions prior to 1.033.
How does CVE-2026-14454 affect Imager for Perl?
CVE-2026-14454 affects Imager for Perl by causing the software to treat unsigned EXIF IFD entry counts as signed, which can lead to severe memory allocation issues.
How do I fix CVE-2026-14454?
To fix CVE-2026-14454, you should upgrade to Imager version 1.033 or later.
What happens if CVE-2026-14454 is not mitigated?
If CVE-2026-14454 is not mitigated, it can result in process termination due to failed memory allocation.