Image::EPEG CVE-2026-3031

Exploitation requires that an application actually invokes Image::EPEG (≤0.15) to decode or thumbnail a JPEG that an attacker can supply or influence - the vulnerable code path is JPEG parsing in the embedded Epeg 0.9.0 library, so an attacker needs a route to deliver untrusted image bytes to that function. Key limiting factors: the risk is inert unless untrusted JPEGs reach the module (applications that only process trusted, internally generated images are not realistically exposed); no specific triggering bug is named in the advisory, so a working exploit depends on an as-yet-unidentified flaw in Epeg 0.9.0; and impact is contingent on the process privileges and any sandboxing around the decoder. This is a use-of-unmaintained-component (CWE-1104) finding, so the condition is essentially 'attacker-controlled JPEG processed by the abandoned embedded library' rather than a single documented configuration switch.

The signals conflict and should temper the headline severity. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) implies trivial remote, unauthenticated total compromise, but this rating is theoretical: the CVE describes the presence of an unmaintained library, not a proven exploitable primitive. CISA SSVC corroborates the ambiguity - Exploitation is rated 'none' (no observed or public exploitation), Automatable 'yes', and Technical Impact 'total'. EPSS is low at 0.17% (7th percentile), there is no KEV listing, and no public exploit is identified. In practice this is a supply-chain hygiene finding rather than a confirmed weaponizable RCE: real risk materializes only where the module processes untrusted JPEGs, and even then depends on an as-yet-unidentified concrete bug in Epeg 0.9.0. Note also that the tag 'Information Disclosure' conflicts with the CVSS I:H/A:H (full integrity/availability impact) - verify the actual impact class with the reporter before treating this as remote code execution.

An attacker submits a specially crafted JPEG to an application that uses Image::EPEG to generate thumbnails (for example an upload-and-resize web endpoint); the malformed image triggers a memory-corruption condition in the embedded 2004 Epeg 0.9.0 decoder, potentially crashing the worker or, in the worst case implied by the CVSS, achieving code execution in the process context. No public exploit is identified at time of analysis, and successful exploitation depends on a concrete parser bug in Epeg that has not been demonstrated in the provided data.