EUVD-2026-42226
GHSA-j48m-64vj-6rm9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated crafted image needs no privileges or interaction (AV:N/AC:L/PR:N/UI:N), but described impact is only a worker crash, so C:N/I:N/A:H.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed.
Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process.
An attacker could craft an image with EXIF data that terminates a worker process.
AnalysisAI
Denial of service in the Imager image-processing module for Perl (all versions before 1.033) allows remote attackers to crash a worker process by submitting an image whose EXIF IFD entry count is mishandled as a signed integer, triggering an near-address-space-sized memory allocation that fails and aborts the process. Any application that passes untrusted images through Imager's EXIF parsing is exposed. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and it is not listed in CISA KEV.
Technical ContextAI
Imager is a widely used CPAN module (distribution TONYC/Imager, CPE cpe:2.3:a:tonyc:imager) for reading, writing, and manipulating images in Perl. The flaw sits in its EXIF metadata parser: an EXIF Image File Directory (IFD) declares an entry count that is unsigned in the file format, but Imager read it into a signed type (CWE-196, Unsigned-to-Signed Conversion Error). A large count therefore wraps to a negative number, and the subsequent size calculation produces a value near the full size of the address space. The resulting allocation request cannot be satisfied, so the process is terminated. The root cause is purely a type/interpretation error in count handling, not a memory-corruption or code-execution primitive.
RemediationAI
Vendor-released patch: upgrade Imager to 1.033 or later (CPAN release TONYC/Imager-1.033); the upstream fix is commit 06f01a5d0fd591259aeba589370d6888384a6b6d (https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d.patch), and release notes are at https://metacpan.org/release/TONYC/Imager-1.033/changes with advisory context at https://seclists.org/oss-sec/2026/q3/98. Because the fix is in a tagged release, upgrading is the clear primary action. If an immediate upgrade is not possible, compensating controls include stripping or skipping EXIF parsing for untrusted images before handing them to Imager, and running Imager-based processing in isolated, auto-restarting worker processes (or a sandboxed job queue with memory/time limits) so that a killed worker degrades throughput rather than the whole service - the trade-off is added operational complexity and possible loss of legitimate EXIF metadata. Rejecting or size-bounding images at ingest reduces but does not eliminate exposure, since the trigger is the EXIF entry count, not file size.
The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unsp
Heap buffer overflow in Imager for Perl versions through 1.030 allows remote attackers to corrupt memory and potentially
Heap buffer overflow in Imager::File::GIF (Perl image processing library) versions through 1.002 allows local attackers
Same weakness CWE-196 – Unsigned to Signed Conversion Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today