The vulnerability arises in the copy_string_tags() function of TONYC Imager versions from 0.45_02 before 1.034 for Perl. When an ASCII EXIF tag has a zero count, entry->size is zero, leading to a computed length of -1. This length is passed to i_tags_add(), which calls strlen() on the tag, causing an over-read beyond the intended buffer boundary. This results in adjacent heap bytes being copied into the exif_* tag. The issue affects JPEG and WEBP image processing paths via im_decode_exif() and Imager::File::WEBP. The vulnerability allows an attacker supplying a crafted image to cause exposure of adjacent heap memory through the EXIF tags returned by Imager->read().

An attacker can supply a malicious image with a crafted zero-count ASCII EXIF entry that triggers an out-of-bounds read, causing adjacent heap memory to be exposed in the returned EXIF tags. This can lead to information disclosure of potentially sensitive memory contents. There is no indication of code execution or denial of service. The CVSS score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to Imager version 1.034 or later when available, as the issue is fixed by upgrading. Until then, avoid processing untrusted images with vulnerable versions of Imager.