CVE-2026-14454

Katalog CVE

CVSS 9.8 · Critical EPSS 0,66%

Kerentanan Unsigned to Signed Conversion Error pada tonycoz imager. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process. An attacker could craft an image with EXIF data that terminates a worker process.

Rincian

Terbit di NVD

8 Juli 2026

Terakhir diubah

10 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-196: Unsigned to Signed Conversion Error
CWE-789: Memory Allocation with Excessive Size Value

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d.patch patch
• http://www.openwall.com/lists/oss-security/2026/07/08/6 mailing list · patch · advisory pihak ketiga
• https://metacpan.org/release/TONYC/Imager-1.033/changes release notes