Executive brief
Imager::File::JPEG is a Perl library used for processing and reading JPEG images, often used in web applications for image uploads or thumbnail generation. A flaw in how it handles specific image metadata (APP13 markers) causes the software to leak memory every time it processes a specially crafted image. Over time, this can exhaust all available system memory, causing the application or server to crash and resulting in a denial of service.
Technical details
A memory leak exists in the i_readjpeg_wiol function of Imager::File::JPEG. When processing a JPEG file containing multiple APP13 (IPTC) markers, the code allocates a new buffer for each marker using mymalloc() and overwrites the existing pointer (*iptc_itext) without first freeing the previously allocated memory. Only the final marker's payload is eventually converted to a Perl scalar and freed. An attacker can provide a JPEG with numerous APP13 markers to cause significant heap memory exhaustion in long-lived processes like image upload services or thumbnailers. The vulnerability is fixed in Imager::File::JPEG version 1.003 and the main Imager distribution version 1.032.
Affected products
- TONYC Imager::File::JPEG < 1.003
- TONYC Imager < 1.032
Timeline
- 2026-06-30: patched: Fix committed to repository
- 2026-07-06: disclosed: CVE published