CVE-2026-14454 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-14454 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-14454 is an integer signedness vulnerability in Tonycoz Imager, a Perl image processing library, affecting all versions prior to 1.033, triggered during the parsing of EXIF metadata in image files.

Technical Detail

The flaw exists in how Imager handles EXIF IFD (Image File Directory) entry count values: the library incorrectly treats unsigned 32-bit count fields as signed integers, causing large count values to be interpreted as negative numbers. An attacker can craft a malicious image file containing an oversized EXIF IFD entry count to trigger this mishandling, which can lead to memory corruption conditions such as heap buffer overflows or out-of-bounds reads. Depending on how the affected application processes attacker-supplied images, this could result in denial of service or potentially remote code execution.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is assessed as none, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No public proof-of-concept code has been identified as of July 15, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this vulnerability.

What To Do

Upgrade Imager to version 1.033 or later immediately. Given the CVSS score of 9.8 and the nature of the flaw, this should be treated as a high-priority patch for any Perl application that processes user-supplied or externally sourced image files. Organizations unable to patch immediately should consider restricting or sanitizing image inputs at the application boundary and avoiding processing of untrusted EXIF-containing files until the patch is applied. Monitor application logs for anomalous image parsing errors or unexpected process crashes, which may indicate attempted exploitation.