EUVD-2026-54561Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-delivered crafted image; no auth or interaction needed; only confidentiality impacted via heap over-read leak.
Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e).
CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Lifecycle Timeline
5DescriptionCVE.org
Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags.
copy_string_tags() computes an ASCII EXIF tag's length as entry->size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry->size to 0, and the derived length reaches i_tags_add() as -1, which is interpreted as a request to call strlen(), scanning past the entry to the next NUL and copying those bytes into the tag. JPEG reaches this path via im_decode_exif(), as does the separate Imager::File::WEBP distribution, which is fixed by upgrading Imager.
Any caller of Imager->read() on an attacker-supplied image with such an entry may receive an exif_* tag holding adjacent heap bytes instead of an empty string.
AnalysisAI
Heap memory disclosure in Imager for Perl (versions 0.45_02 through < 1.034) exposes adjacent heap bytes to any application that processes attacker-supplied JPEG or WEBP images and surfaces EXIF tag values. The root cause is a signed integer underflow in copy_string_tags() that causes strlen() to scan past a zero-count ASCII EXIF entry, copying arbitrary heap contents into the exif_* tag returned to the caller. Publicly available exploit code exists (confirmed by the exifattack.bin fixture in the upstream patch commit), and SSVC rates exploitation as automatable; no CISA KEV listing indicates active mass exploitation has not yet been confirmed.
Technical ContextAI
The vulnerability resides in imexif.c within Imager's TIFF/EXIF parsing logic. The affected function copy_string_tags() computed an ASCII EXIF tag's usable length as entry->size - 1 to strip a trailing NUL. When a crafted EXIF entry carries a zero count, entry->size equals 0 and the subtraction yields -1 as a signed int. The downstream function i_tags_add() interprets -1 as a sentinel value requesting a strlen() call rather than an explicit byte count, causing it to scan from the entry's buffer start past the entry boundary into adjacent heap memory until the next NUL byte is found; those bytes are then copied into the tag string. CWE-125 (Out-of-bounds Read) precisely characterises this: the read operation crosses the allocated object's boundary. JPEG images reach this path via im_decode_exif(), and WEBP images reach it via the Imager::File::WEBP distribution, which delegates EXIF handling to the same core library. CPE: cpe:2.3:a:tonyc:imager:*:*:*:*:*:perl:*:* spanning versions 0.45_02 to 1.033 inclusive.
RemediationAI
Upgrade Imager to version 1.034 or later via CPAN (cpanm Imager or cpan -i Imager); this is the vendor-released patch and resolves the vulnerability for both JPEG and WEBP image paths including the Imager::File::WEBP distribution. The upstream commit implementing the fix is at https://github.com/tonycoz/imager/commit/24bde0427a113264d53f45a9c29ae756d84c82fe.patch and the full security advisory is at https://github.com/tonycoz/imager/security/advisories/GHSA-hx46-55wp-hv6m. If immediate patching is not possible, the most effective compensating control is stripping or sanitising EXIF data from untrusted images before passing them to Imager->read(), using an external utility such as ExifTool (exiftool -all= input.jpg) - this removes the malformed zero-count entry before it reaches the vulnerable code path; the trade-off is loss of legitimate EXIF metadata. A secondary control is to suppress or discard exif_* tag values returned by Imager before they reach API responses or logs, which prevents attacker retrieval of leaked bytes even if the over-read occurs internally; this does not eliminate the over-read but eliminates the disclosure channel. Restricting image upload endpoints to authenticated trusted users reduces network exposure but is insufficient as a sole mitigation if internal systems also process externally sourced images.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today