CVE-2026-14454

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14454
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14454.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14454
Downstream
Published
2026-07-08T12:30:20Z
Modified
2026-08-12T15:31:22Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed
Details

Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed.

Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process.

An attacker could craft an image with EXIF data that terminates a worker process.

Database specific 
{
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-196",
        "CWE-789"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14454.json"
}
References

Affected packages

Git / github.com/tonycoz/imager

Affected ranges

Type
GIT
Repo
https://github.com/tonycoz/imager
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
960096a2d6264c5c1862843a7fd1c4414dd9f7bd
Fixed
06f01a5d0fd591259aeba589370d6888384a6b6d
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:tonycoz:imager:*:*:*:*:*:perl:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.033"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

Imager-0.*
Imager-0.49
Imager-0.51_01
Imager-0.51_02
Imager-0.52
Imager-0.53
Imager-0.55
Imager-0.58
Imager-0.59
Imager-0.60
Imager-0.61
Imager-0.63
Imager-0.65
Imager-0.71
Imager-0.72
Imager-0.75
Imager-0.76
Imager-0.77
Imager-0.78
Imager-0.79
Imager-0.80
Imager-0.81
Imager-0.82
Other
Imager-0_38
Imager-0_38pre9
v0.*
v0.82_01
v0.83
v0.84
v0.84_01
v0.84_02
v0.85
v0.85_01
v0.85_02
v0.86
v0.87
v0.88
v0.89
v0.90
v0.91
v0.92
v0.93
v0.94
v0.94_01
v0.94_02
v0.95
v0.96
v0.96_01
v0.96_02
v0.97
v0.98
v0.99
v0.99_01
v0.99_02
v1.*
v1.000
v1.001
v1.002
v1.003
v1.004
v1.004_001
v1.004_002
v1.004_003
v1.004_004
v1.005
v1.006
v1.007
v1.008
v1.009
v1.010
v1.011
v1.012
v1.013
v1.014
v1.015
v1.016
v1.017
v1.018
v1.019
v1.020
v1.021
v1.022
v1.023
v1.024
v1.025
v1.026
v1.027
v1.028
v1.029
v1.030
v1.031
v1.032

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14454.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "288119952689490571639906918839749396737",
            "length": 827
        },
        "id": "CVE-2026-14454-0bb4c699",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d",
        "target": {
            "file": "imexif.c",
            "function": "tiff_get_tag_int_array"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "209940944599995741125802503754249354238",
            "length": 408
        },
        "id": "CVE-2026-14454-0f98ee39",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d",
        "target": {
            "file": "imexif.c",
            "function": "tiff_get_tag_int"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "181899595244314167947351606522425521003",
            "length": 1970
        },
        "id": "CVE-2026-14454-141ba201",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d",
        "target": {
            "file": "imexif.c",
            "function": "copy_num_array_tags"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "47141635543494058049578696720073849604",
            "length": 418
        },
        "id": "CVE-2026-14454-143ba32b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d",
        "target": {
            "file": "imexif.c",
            "function": "copy_rat_tags"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "268264964214836298943391938962923881062",
            "length": 96
        },
        "id": "CVE-2026-14454-289cc5e6",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d",
        "target": {
            "file": "imexif.c",
            "function": "process_maker_note"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "175490625044455170483926426515299886109",
            "length": 1334
        },
        "id": "CVE-2026-14454-55453e97",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d",
        "target": {
            "file": "imexif.c",
            "function": "save_exif_ifd_tags"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "59056221672954888657136896382634564407",
            "length": 487
        },
        "id": "CVE-2026-14454-58312fbc",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d",
        "target": {
            "file": "imexif.c",
            "function": "copy_string_tags"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "251574386366291380815545720390785931910",
            "length": 970
        },
        "id": "CVE-2026-14454-76fbab9a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d",
        "target": {
            "file": "imexif.c",
            "function": "tiff_get_tag_double_array"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "318597482152435896662024117742629568841",
            "length": 410
        },
        "id": "CVE-2026-14454-80a26021",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d",
        "target": {
            "file": "imexif.c",
            "function": "copy_int_tags"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "191872364381049172483617689580842531918",
            "length": 414
        },
        "id": "CVE-2026-14454-ae3dd3e4",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d",
        "target": {
            "file": "imexif.c",
            "function": "tiff_get_tag_double"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "141772196158586170022385055604413783071",
            "length": 1535
        },
        "id": "CVE-2026-14454-b4c70f81",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d",
        "target": {
            "file": "imexif.c",
            "function": "tiff_load_ifd"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "115428763606425976539461522679978415738",
            "length": 707
        },
        "id": "CVE-2026-14454-cf8a6bf5",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d",
        "target": {
            "file": "imexif.c",
            "function": "save_ifd0_tags"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "224031624918338099866931816478545886422",
            "length": 789
        },
        "id": "CVE-2026-14454-f20dec26",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d",
        "target": {
            "file": "imexif.c",
            "function": "im_decode_exif"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "290996822707451789179142029795669789715",
                "331156938045189713761107025841626661065",
                "69027853967865140623415972144290701075",
                "79865782720434561710683368201277376321",
                "281020327245647316002124502400071296571",
                "192419711509981465618629632597260392260",
                "107472718218891988610275549784382921940",
                "68288927278790881230847178147301194689",
                "292159661839409985492111809044932648998",
                "152066800258111806197434646039767256356",
                "307667596949947518949077834711127583930",
                "26148779543060180319616774504939179453",
                "187083594322349816608927698348350074614",
                "2248687887427087288139984435883908621",
                "204949645069698233691149211143099220199",
                "14597884982753767182892764097947007863",
                "165489766638969690189099381775357938164",
                "264422271779952274501134278904042354818",
                "169104633164768828363977276797949313400",
                "7288573473776557201309198284942121891",
                "297914544641502305596981916587875046979",
                "253210372918748859251549449818523265780",
                "69963634380755853063561911899970476594",
                "100819380983552576456668201090611117377",
                "124063627258192575971066487923193525190",
                "226364766767082103983359074360563613744",
                "9691262224052107601603928246695684697",
                "99112259057985152866888482204665154992",
                "8894812973919650823384835824219467269",
                "25632339700330777516295097790723547754",
                "10344293204559472756566602995782667644",
                "163077989669712185117798540051530765502",
                "14688397211537531501448216770529922104",
                "260696516886775320728344322476459713226",
                "66879513326158266759387190264909633281",
                "287737200150495992619870170170615328311",
                "317332543980634687750158946925915265568",
                "267257945062479995070264433980771468280",
                "307331859700029115496331330620841290043",
                "222799321278578552093655050941677446137",
                "113351666744152716995066334673789037897",
                "214556382387787559059462300424489177668",
                "10436590163769631900380389868933212272",
                "263298883375392230534974077002664605660",
                "331656830272038651835605962091827015152",
                "116315395940461233537200709271520709104",
                "74266794957687462916795826479200565281",
                "171935574589238064333769464655653650431",
                "25344864693118898659559179024706504112",
                "109053708490266972613264680486140686424",
                "142913257367697128126498130371990825865",
                "126621424857038439061116337904522841981",
                "142778143311268753544657803022918561571",
                "297282179988507509906212011610259819019",
                "142040852966717133915765230439656263549",
                "171783568019523796809314841971485151225",
                "321144182187833685655805871915682319506",
                "64998097154884305847271922871523490328",
                "306620930466646244024579628313148825095",
                "321703490403424239578210056741846021930",
                "276451741640167951266464895262290580177",
                "182696153449527286266856649356621929212",
                "121874756130699549399794864308291365972",
                "34554990822697612884532420030296234295",
                "286964600884606183482389017466936309858",
                "158425362619762410374505563966348379770",
                "16810961533341670924214601973710651358",
                "321770031473116235828354907559721260542",
                "44703653359789255662522645760328233538",
                "334005688919152241928861994628958964608",
                "95297838138380897934609731163873361583",
                "150850943040639727468689513361689955117",
                "105282579813064338988477363171288490750",
                "158097165430981541947317353097306466109",
                "97360857842735929420668612454186194589",
                "324212050760517602548203694304102031483",
                "297071142871204493898449395425388318834",
                "9340907421308673952392391355869830659",
                "266527964125293828157715173704688845810",
                "37717331984000099650076030735281175125",
                "74061220412920211945153385616193377045",
                "169527326207668886634082577505553821758",
                "181419995205065864150831940654263397321",
                "44540492403081926815141016447013837376",
                "93295687154765316288451571098263919263",
                "339387664228315570468208483792822846131",
                "276139149078901402825694057215364172931",
                "35717594555380470276891382096213373264",
                "142810481819102140688775670887081409412",
                "166837334953078059529195636648018829153",
                "333103522418880635389919994578772243742",
                "219983494665138406206744754482137486185",
                "41116776272820369959853351069213465301",
                "182822689357328672729449434454904755590",
                "35688911452966315805847656302345642157",
                "304693748354200749272134860972596092583",
                "3962701281750797764811258973390072218",
                "141062171642225436862888287194449399245",
                "153620513868962706884196545876111792766",
                "251565783308862545925758738985427425409",
                "118160224631612343029021668726230200913",
                "157102573418444383362223095443132190510",
                "114407138650637560714257847628760231818",
                "255163987206763302646704975324369270538",
                "166911128716627335716206089376158304612",
                "57669508888460164717502905874980500355",
                "283998666527466984703435372894421144168",
                "288212074773709240304378556698230759788",
                "151071970552310067887071773852401503773",
                "300374276423437196316375447902727719322",
                "333132762602319941118496617919595406110",
                "71195971185167979434695472283845262962",
                "277256036008831550001974287547850257749",
                "11071107209293190630891421718601801437",
                "126299362269151071202553134010838233069",
                "41480303422981839467579556712142775466",
                "196367740746484069706409136945276148079",
                "309394480156979963786635375923276947015",
                "89337534414110270136689924340720522716",
                "231292839157625897404604992873317378185",
                "314310606962451860936986071095832147524",
                "4133356074583453225684585146174013531",
                "129391006458952109076574760500801570209",
                "289948189860307975544191751803349075942",
                "166911128716627335716206089376158304612",
                "150888866293810167714966353975145435374",
                "109059498864888095592701680150168251853",
                "218374996173381161823654785498680155573",
                "122708316853078092839631904330311443154",
                "23470797475807072283166788666544924798",
                "210917118146821290639267618252601430960",
                "60053263266039158024865841577817383808",
                "160294110008737110198457878023263907382",
                "246809602935824288647659307282037405",
                "12568946124628295071887195010440054632",
                "118417736805117940477353314063087008624",
                "327085608682101434671183037650883569444",
                "76996301958635414511614735961004127781",
                "294713692369073312822607372763400811688",
                "71515227360194792410298285512820827395",
                "290127958219732486577082364326519702845",
                "246324384368114402334132677577280840582",
                "3617080514870456427666010297389991403",
                "283121257879874688332011742676219091857",
                "193603196263599631485463787182428897026",
                "290127958219732486577082364326519702845",
                "265066138266074154912368889957064720796",
                "156659647227379388128751140283725134952",
                "20818029219586297952920763469838826829",
                "245963198120816995664852825549159510202",
                "290127958219732486577082364326519702845",
                "57523591485409485610330344102613531634",
                "225550491426442054590748566556152454505",
                "291513515351978758786112347843488759067",
                "213289134439321574576433279154819991246",
                "218705233616496882062002975504692582513",
                "21377563207949471326864882412195515838",
                "265939229226796645990767743859906593009",
                "47076944053060655507186442203481854524",
                "213888302352658946952578211787000022767",
                "209565673855641652054536678445375970348",
                "166944275584590108367529483604932425916",
                "325144844157490742769938975459365935757",
                "95917493364961957233451677890967724450",
                "301876647903154980438469820840147580514",
                "3840976705563240710421912213908908230",
                "209478505721182068691180944483239412843",
                "228958646075474336549912422978978174320",
                "27810214156368821901524488475106911936",
                "211123892318322042805673711647710062712",
                "76558002087104678375802012014342639816",
                "287032450763721810402566830158496654666",
                "77376000978759589609052871786700184998",
                "311127467507321179645629427596180441931",
                "336695299122760678946412902366617460166",
                "218089596470183767061090458652434692449",
                "4749989498730930578557470877900392410",
                "202886020797614470106888663116537298164",
                "241725112378736432540122108454159691261",
                "187611910950952834569181512781017854005",
                "198866694276502785817240123193272578400",
                "181730560858708549782580535439201734274",
                "182103162464500729586911876119551644939",
                "340104554215563991789656975723027665411",
                "47146124478789122355883725840933109275",
                "167093149032351354636910042506033692137",
                "241616237666092268055219313724792584773",
                "182045659051633589876622816926210336554",
                "104443221560378612819959754935778267367",
                "304917146646208860524191670746840463903",
                "238272929217294972869760189396283030629",
                "148684722902418108905126884724526255506",
                "95917493364961957233451677890967724450",
                "204563101878754278609736358401012650991",
                "131879686464624191778448555591128932850",
                "55939455675932222427223726409274603736",
                "326213033220953892470692241902917259127",
                "117529643557394367125593797260103152026",
                "211123892318322042805673711647710062712",
                "76558002087104678375802012014342639816",
                "287032450763721810402566830158496654666",
                "77376000978759589609052871786700184998",
                "311127467507321179645629427596180441931",
                "336695299122760678946412902366617460166",
                "218089596470183767061090458652434692449",
                "4749989498730930578557470877900392410",
                "209647285624782712395717225660681191044",
                "146028682522701916149115197363447446060",
                "122757731381897903313870283416859150078",
                "125789893635776857090002043519215628030",
                "299162155500179479218748643711163777621",
                "30047864945274350220440737915674868974",
                "340104554215563991789656975723027665411",
                "47146124478789122355883725840933109275",
                "311608772555179261869098780573614852777",
                "85753619746934619727163979089189631176",
                "236732265184660035366467935863000898408",
                "75407180318704451699303769443305508093",
                "181871691894951821194870664884002812817",
                "61607654267763349356889484599188299582",
                "227670327798767125639365138671980198174",
                "255378121566812524371231721540743064370",
                "218705233616496882062002975504692582513",
                "108995356824732724068739099010329993901"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-14454-f2686ceb",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d",
        "target": {
            "file": "imexif.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "47419793795650671299306724760742616551",
            "length": 629
        },
        "id": "CVE-2026-14454-f5922f3f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b6d",
        "target": {
            "file": "imexif.c",
            "function": "copy_name_tags"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T15:31:22Z"