CVE-2026-14454: Imager for Perl DoS Vulnerability

CVE-2026-14454 Overview

CVE-2026-14454 affects Imager versions before 1.033 for Perl. The library treats unsigned EXIF Image File Directory (IFD) entry counts as signed integers. When Imager encounters a large IFD entry count, the value is interpreted as a negative number and later used in an allocation calculation. The result is an attempt to allocate a block nearly the size of the address space, which fails and terminates the process. An attacker can craft an image with malformed EXIF data to reliably kill a worker process that parses the image. This weakness is classified as [CWE-196] Unsigned to Signed Conversion Error.

Critical Impact
A crafted image with malicious EXIF metadata terminates any Perl worker process using Imager to parse image files, enabling denial-of-service against image processing pipelines and web workers.

Affected Products

Imager for Perl versions prior to 1.033
Applications and web services that use Imager to parse EXIF metadata from user-supplied images
Perl workers or job queues that decode untrusted image uploads

Discovery Timeline

2026-07-08 - CVE-2026-14454 published to the National Vulnerability Database (NVD)
2026-07-08 - Public discussion posted on the OpenWall OSS-Security list
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-14454

Vulnerability Analysis

Imager is a widely used Perl module for reading, writing, and manipulating image files. During EXIF parsing, the module reads the entry count field of an IFD from the image header. The EXIF specification defines this field as an unsigned 16-bit or 32-bit integer, but Imager stored and processed the value using a signed integer type. Large legitimate-looking or intentionally malformed counts wrap into large negative values, which then flow into buffer sizing arithmetic. The subsequent allocation request approaches the full virtual address space and fails, causing the interpreter to abort the parsing process.

Root Cause

The root cause is an unsigned-to-signed conversion error in the EXIF IFD parser. The entry count and directory entry offset fields were not validated against structural limits before being used in pointer arithmetic and memory allocation. Test fixtures added in the patch (exifbadoff.bin, exifbadderoff.bin, exifbadifdoff1.bin, exifbadifdoff2.bin) confirm the bug affects both bad directory entry offsets and (U32)-1 IFD offsets that manifest as index wrap.

Attack Vector

An attacker crafts an image (JPEG or TIFF with an EXIF segment) whose IFD entry count or directory offset is set to a value that becomes negative under signed interpretation. The attacker submits this image to any service that uses Imager for decoding, thumbnail generation, or metadata extraction. Parsing terminates the worker process. In pooled or forked worker architectures, repeated submissions exhaust available workers.

text

// Files added by the security patch demonstrating the trigger conditions
t/data/exifbadoff.bin       EXIF with bad directory entry offset
t/data/exifbadderoff.bin    EXIF with (U32)-1 DE offset
t/data/exifbadifdoff1.bin   EXIF with (U32)-1 DE offset
t/data/exifbadifdoff2.bin   EXIF with (U32)-1 DE offset
// Source: https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d.patch

Detection Methods for CVE-2026-14454

Indicators of Compromise

Unexpected termination of Perl worker processes that handle uploaded images, with no core dump beyond a failed large allocation
Repeated SIGABRT or out-of-memory signals from processes linking Imager.so
Image uploads containing EXIF IFD entry counts at or near 0xFFFFFFFF or negative signed equivalents
Elevated rate of HTTP 5xx responses from endpoints that accept image uploads

Detection Strategies

Inspect EXIF IFD headers on ingress and reject images whose IFD entry counts exceed the number of bytes remaining in the EXIF segment
Monitor worker process lifetimes and correlate crashes with the SHA-256 hashes of recently processed image uploads
Compare installed Imager versions across hosts using perl -MImager -e 'print $Imager::VERSION' and flag any version below 1.033

Monitoring Recommendations

Alert on abnormal restart counts for fastcgi, Starman, or Plack workers that call Imager
Log the sizes and MIME types of uploaded images and retain suspect files for offline analysis
Track allocation failures in system logs (vm.overcommit, OOM killer messages) tied to processes loading Imager

How to Mitigate CVE-2026-14454

Immediate Actions Required

Upgrade Imager to version 1.033 or later using cpan Imager or your distribution package manager
Inventory all Perl applications and identify any dependency on Imager, including transitive dependencies
Restrict image upload endpoints to authenticated users while the upgrade is rolled out
Rate-limit image processing per source IP to reduce worker exhaustion risk

Patch Information

The fix is committed upstream and shipped in Imager 1.033. Review the GitHub Patch for Imager and the MetaCPAN Imager Changes for the complete change log. The patch validates EXIF IFD offsets and entry counts before use and adds regression fixtures that reproduce the crash.

Workarounds

Strip EXIF metadata from uploaded images before passing them to Imager, using a tool such as exiftool -all= in a preprocessing step
Reject images whose EXIF segment size or IFD entry count exceeds sane limits at the web-server or WAF layer
Isolate image parsing in a sandboxed process with a bounded memory limit so that a crash does not affect the main service

bash

# Upgrade Imager to the fixed release
cpan install Imager@1.033

# Verify the installed version
perl -MImager -e 'print "Imager version: $Imager::VERSION\n"'

# Optional: pre-strip EXIF before handing images to Imager
exiftool -overwrite_original -all= /path/to/upload.jpg