EUVD-2026-44967
GHSA-4gpm-fvvv-c6c5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote untrusted JPEG reaches an old decoder (AV:N, PR:N), but exploitation needs an undemonstrated parser bug and crafted input (AC:H); a crash/DoS is the most likely outcome (A:H) with lower confirmed C/I impact.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library.
Image::EPEG includes Epeg 0.9.0 that was last updated in 2004.
Epeg is a fast JPEG thumbnail library that was once part of the Englightenment Project.
AnalysisAI
Use of an unmaintained third-party component in the Perl module Image::EPEG (through version 0.15) exposes users to any latent flaws in the bundled Epeg 0.9.0 JPEG thumbnailing library, which was last updated in 2004 and is no longer supported. Reported by CPANSec (CWE-1104), the core issue is that any JPEG-decoding vulnerability in this two-decade-old embedded library will never receive an upstream fix. There is no public exploit identified at time of analysis, EPSS exploitation probability is low (0.17%), and the assigned CVSS of 9.8 appears to reflect worst-case memory-corruption potential in image parsing rather than a specific demonstrated flaw.
Technical ContextAI
Image::EPEG is a Perl XS binding (CPE cpe:2.3:a:tokuhirom:image::epeg) that statically embeds Epeg, a fast JPEG thumbnail-generation library originally developed as part of the Enlightenment desktop project. The bundled copy is Epeg 0.9.0, released in 2004 and available only from SourceForge/Enlightenment OldFiles, meaning it receives no security maintenance. The root-cause class is CWE-1104 (Use of Unmaintained Third Party Components): the danger is not a single named memory-safety bug but the aggregate, unpatched attack surface of a legacy C image parser that decodes attacker-controllable JPEG data (Epeg wraps libjpeg operations for scaling/thumbnailing). Any buffer overflow, integer overflow, or out-of-bounds condition in that 2004 code path is permanently unfixed upstream.
RemediationAI
No vendor-released patch identified at time of analysis - the CVE describes an unmaintained embedded dependency and no fixed Image::EPEG version is cited in the input. Because Epeg 0.9.0 is abandoned upstream, the durable fix is to migrate away from Image::EPEG to an actively maintained JPEG thumbnailing path such as Image::Magick, Imager, or GD backed by a current libjpeg-turbo, rather than waiting for a patched release; if the module must be retained, rebuild or link it against a maintained Epeg fork or a current libjpeg so the 2004 decoder is not in the data path (trade-off: XS re-linking may break the module's ABI and requires testing). As compensating controls where the module cannot be removed, do not feed untrusted or user-uploaded JPEGs to Image::EPEG (restrict it to trusted, internally generated images), validate and constrain image dimensions and file size before decoding, and sandbox the thumbnailing process (seccomp/container/separate low-privilege worker) so a decoder crash cannot compromise the host - the side effect is added operational complexity and potential throughput loss. Track the NVD/EUVD advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-3031) for any future fixed release.
We need to produce a JSON with the specified fields. Let's analyze the input data carefully. CVE ID: CVE-2026-58586 Des
An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Rated critica
An issue was discovered in the image crate before 0.23.12 for Rust. Rated medium severity (CVSS 5.5), this vulnerability
The TIFF decoder does not place a limit on the size of compressed tile data. Rated medium severity (CVSS 6.5), this vuln
A maliciously-crafted image can cause excessive CPU consumption in decoding. Rated medium severity (CVSS 6.5), this vuln
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today