Quick answers
- Is CVE-2026-14454 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14454 being exploited in the wild.
- How severe is CVE-2026-14454?
- Informational severity, with a CVSS score of 3.3, published 8 July 2026.
- Which products and versions are affected?
- Tony Cook Imager before 1.033.
- Is there a fix for CVE-2026-14454?
- A patch was published on 2026-07-04: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-14454 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-14454?
- Check whether you run Tony Cook Imager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A signedness error (CWE-196) exists in the EXIF parsing logic of Imager (specifically in `imexif.c`). The library treats unsigned EXIF Image File Directory (IFD) entry counts as signed integers. When a large value is encountered, it is interpreted as a negative number, which subsequently leads to an excessive memory allocation request (CWE-789) near the size of the address space. This allocation failure triggers a process crash. An attacker can exploit this by providing a crafted image with malicious EXIF metadata to cause a Denial of Service (DoS). The issue is fixed in version 1.033 by updating the relevant types to `unsigned` and `size_t`.
Affected products
- TONYC (Perl CPAN) Imager before 1.033
Timeline
- 2026-07-04: patched: Fix committed to repository
- 2026-07-08: disclosed: CVE published