Imager (Perl) CVE-2026-14454

Exploitation requires that the target application passes attacker-supplied image data to Imager and that Imager's EXIF parsing path is reached (e.g. image upload, thumbnailing, or metadata extraction of formats carrying EXIF such as JPEG/TIFF). The specific trigger is an EXIF IFD entry count large enough to be misread as a negative value, causing the near-address-space allocation. No authentication is required per the CVSS vector (PR:N) and no user interaction is needed (UI:N). Limiting factors: the application must actually invoke Imager on untrusted images and process their EXIF data - a deployment that never parses EXIF or never accepts untrusted images is not exposed; impact is confined to termination of the processing worker (availability), not data exposure or code execution.

The signals conflict sharply and should be weighed carefully. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) overstates real impact: the description describes only a failed allocation that kills a worker process, i.e. an availability/DoS outcome with no confidentiality or integrity loss - the C:H/I:H are not supported by the described behavior and should be treated as availability-only (verify with vendor). CISA SSVC aligns better with a lower urgency: Exploitation 'none' (no observed exploitation), Automatable 'yes' (a single crafted image reliably triggers it), Technical Impact 'total' (the affected worker is fully taken down). EPSS is low (0.18%, 8th percentile), there is no KEV listing and no public exploit code. The vendor 'Information Disclosure' tag is not supported by the description and appears to be a mislabel - this is a crash, not a disclosure. Net: a genuine but modest DoS risk for services that feed attacker-controlled images into Imager; easily weaponized for availability but not a data-breach or RCE priority, so the effective severity is well below the 9.8 headline.

An attacker uploads a profile picture or submits an image to a Perl web service that uses Imager to read metadata or generate thumbnails. The image contains an EXIF IFD with an oversized entry count that Imager interprets as negative, causing a huge allocation that fails and kills the worker handling the request. Repeated submissions can keep worker processes crashing, degrading or denying service; no public exploit code has been identified, but the crafting is straightforward.