CVE-2026-14454 Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed
An attacker can cause a denial of service by crafting an image with malicious EXIF data that triggers a memory allocation failure in the Imager Perl library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-14454?
CVE-2026-14454 is a critical vulnerability in TONYC Imager, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed.
Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process.
An attacker could craft an image with EXIF data that terminates a worker process.
Which versions are affected by CVE-2026-14454?
It affects 1 product.
Products include Tonycoz Imager.
How do I fix CVE-2026-14454?
Upgrade to a fixed version.
Is CVE-2026-14454 being exploited?
There is no known exploitation of CVE-2026-14454 in the wild and no public exploit code.
Other vulnerabilities in TONYC Imager
Sources
Also known as DEBIAN-CVE-2026-14454, GHSA-j48m-64vj-6rm9, UBUNTU-CVE-2026-14454.