CVE-2026-13708: Imager::File::JPEG Memory Leak DoS

CVE-2026-13708 Overview

CVE-2026-13708 is a heap memory leak vulnerability in Imager::File::JPEG versions before 1.003 for Perl. The flaw resides in the i_readjpeg_wiol function, which processes JPEG marker lists returned by libjpeg. When a JPEG contains repeated APP13 markers, the handler allocates a new buffer for each marker but overwrites the previous pointer without freeing it. Only the final payload is later converted to a Perl scalar and freed. Repeated reads in long-lived services accumulate leaks until memory is exhausted, producing a denial-of-service condition. The same handler ships bundled in the Imager distribution, where versions before 1.032 are affected.

Critical Impact
Long-running services that parse untrusted JPEGs, such as image upload or thumbnailing pipelines, can be driven to memory exhaustion by attackers submitting crafted images with multiple APP13 IPTC blocks.

Affected Products

Imager::File::JPEG for Perl, versions before 1.003
Imager distribution (bundled JPEG handler), versions before 1.032
Any long-lived Perl service consuming untrusted JPEG input through these modules

Discovery Timeline

2026-07-06 - CVE-2026-13708 published to NVD
2026-07-06 - Disclosure posted to the OpenWall oss-security mailing list
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-13708

Vulnerability Analysis

The vulnerability is a heap memory leak classified under [CWE-401] (Missing Release of Memory after Effective Lifetime). The i_readjpeg_wiol function iterates through the marker list that libjpeg returns for a parsed JPEG. For every APP13 marker encountered, it assigns a freshly allocated buffer to *iptc_itext using mymalloc(...). The previous pointer is overwritten without an intervening myfree, so each iteration except the last orphans a heap allocation.

Only the final APP13 payload is converted into a Perl scalar and eventually released. A JPEG containing N APP13 markers therefore leaks N-1 payloads on every read. In short-lived scripts the impact is negligible, but in persistent workers - upload handlers, thumbnail generators, or media processing daemons - the leaked allocations accumulate across requests until the process exhausts available heap.

Root Cause

The root cause is missing deallocation logic in the APP13 marker loop. The code assumes at most one IPTC payload per image and never accounts for the case where libjpeg surfaces multiple APP13 markers. Assigning to *iptc_itext without first checking whether the pointer already holds an allocation leaves the previous buffer unreferenced and unreachable for cleanup.

Attack Vector

The attack vector is network-reachable and requires no authentication or user interaction. An attacker submits a JPEG containing many APP13 IPTC markers to any service that reads it with the affected module. Each parse leaks memory proportional to the number of markers, and repeated submissions steadily drive the target process toward out-of-memory termination.

text

 use Imager;
 
 BEGIN {
-  our $VERSION = "1.002";
+  our $VERSION = "1.003";
 
   require XSLoader;
   XSLoader::load('Imager::File::JPEG', $VERSION);

Source: GitHub Patch Commit 9f1c485

The patch bumps the module version to 1.003 and, as documented in the MANIFEST diff below, adds a regression test image testimg/iptcdup.jpg with multiple IPTC blocks to prevent recurrence.

text

 t/t10jpeg.t
 t/t20limit.t
 testimg/209_yonge.jpg		Regression test: #17981
+testimg/iptcdup.jpg		Test image for multiple IPTC blocks
 testimg/exiftest.jpg		Test image for EXIF parsing
 testimg/scmyk.jpg		Simple CMYK JPEG image
 testimg/zerotype.jpg		Image with a zero type entry in the EXIF data

Source: GitHub Patch Commit 9f1c485

Detection Methods for CVE-2026-13708

Indicators of Compromise

Steady, unexplained growth in resident set size (RSS) of Perl worker processes that handle image uploads or transformations.
Recurring out-of-memory kills or worker restarts correlated with inbound JPEG processing.
Access logs showing repeated uploads of similarly sized JPEGs from the same client or IP range prior to service degradation.

Detection Strategies

Inventory Perl environments and identify installations of Imager::File::JPEG below 1.003 or Imager below 1.032 using cpan -l or equivalent package queries.
Scan uploaded JPEGs for anomalous APP13 marker counts. Legitimate images typically contain zero or one IPTC block; multiple APP13 markers in a single file warrant inspection.
Correlate application-layer image-parse events with host memory metrics to identify leak patterns tied to specific inputs.

Monitoring Recommendations

Enable per-process memory alerting on services that invoke Imager, with thresholds tuned to normal baseline behavior.
Log request-level metadata for image uploads, including file size and marker structure where feasible, to support post-incident analysis.
Watch for repeated OOM events in dmesg or systemd journal entries tied to image processing workers.

How to Mitigate CVE-2026-13708

Immediate Actions Required

Upgrade Imager::File::JPEG to version 1.003 or later.
Upgrade the bundled Imager distribution to version 1.032 or later where the fix is included.
Restart long-running Perl workers after patching to release any memory already leaked in the current process.
Rate-limit or size-limit JPEG uploads while patching is in progress to reduce exposure.

Patch Information

The fix is committed upstream as 9f1c485ca3ee15dc261549e11afb356866552c3a and released in Imager::File::JPEG 1.003 and Imager 1.032. Full details are available in the GitHub Patch Commit, the MetaCPAN Release Changes, and the OpenWall OSS Security Email.

Workarounds

Reject JPEGs containing more than one APP13 marker at the application boundary before passing them to Imager.
Run image parsing in short-lived worker processes that recycle after a bounded number of requests, capping cumulative leak impact.
Enforce strict per-process memory limits (for example via ulimit, systemdMemoryMax, or container limits) so a leaking worker is terminated and replaced instead of degrading the host.

bash

# Configuration example: upgrade the affected modules via CPAN
cpanm Imager::File::JPEG@1.003
cpanm Imager@1.032

# Verify installed versions
perl -MImager::File::JPEG -e 'print $Imager::File::JPEG::VERSION, "\n"'
perl -MImager -e 'print $Imager::VERSION, "\n"'