# CVE-2026-14454: TONYC Imager unsigned to signed conversion error in EXIF parsing

Source: https://junglewise.ai/threats/cve-2026-14454-tonyc-imager-unsigned-to-signed-conversion-error-in-exif-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-14454 · Severity: info · CVSS 3.3 · Published 2026-07-08

Imager, a Perl library used for image processing and manipulation, contains a flaw in how it handles metadata (EXIF data) in image files. An attacker can provide a specially crafted image that, when processed by the library, causes the application to crash by attempting to allocate an impossible amount of memory. This results in a denial-of-service, potentially stopping web servers or background tasks that process user-uploaded images.

Technologies: [Tony Cook Imager](https://junglewise.ai/threats/technologies/imager). Vendors: [Tony Cook](https://junglewise.ai/threats/vendors/tony-cook).

## Quick answers

**Is CVE-2026-14454 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14454 being exploited in the wild.

**How severe is CVE-2026-14454?** Informational severity, with a CVSS score of 3.3, published 8 July 2026.

**Which products and versions are affected?** Tony Cook Imager before 1.033.

**Is there a fix for CVE-2026-14454?** A patch was published on 2026-07-04: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14454 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14454?** Check whether you run Tony Cook Imager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A signedness error (CWE-196) exists in the EXIF parsing logic of Imager (specifically in `imexif.c`). The library treats unsigned EXIF Image File Directory (IFD) entry counts as signed integers. When a large value is encountered, it is interpreted as a negative number, which subsequently leads to an excessive memory allocation request (CWE-789) near the size of the address space. This allocation failure triggers a process crash. An attacker can exploit this by providing a crafted image with malicious EXIF metadata to cause a Denial of Service (DoS). The issue is fixed in version 1.033 by updating the relevant types to `unsigned` and `size_t`.

## Affected products

- TONYC (Perl CPAN) Imager before 1.033

## Timeline

- 2026-07-04: patched: Fix committed to repository
- 2026-07-08: disclosed: CVE published

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d.patch](https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d.patch)
- [https://metacpan.org/release/TONYC/Imager-1.033/changes](https://metacpan.org/release/TONYC/Imager-1.033/changes)

## Related threats

- [Imager::File::GIF out-of-bounds read in GIF consolidation](https://junglewise.ai/threats/cve-2026-112202-imager-file-gif-versions-before-1-006-for-perl-allow-out-of)
- [Imager heap buffer overflow in i_gsampf_fp fetching float samples](https://junglewise.ai/threats/cve-2026-102505-imager-versions-before-1-037-for-perl-overflow-a-heap-buffer)
- [Imager Perl library heap out-of-bounds write in GIF parser](https://junglewise.ai/threats/cve-2026-8669-imager-perl-library-heap-out-of-bounds-write-in-gif-parser)