UBUNTU-CVE-2026-14454
A vulnerability in libimager-perl versions before 1.033 causes improper handling of unsigned EXIF IFD entry counts by treating them as signed integers. This mishandling can lead to an attempt to allocate an excessively large memory block, causing the process to fail and terminate. An attacker could exploit this by crafting a malicious image with specially formed EXIF data to terminate a worker process.
AI Analysis
Technical Summary
libimager-perl versions prior to 1.033 incorrectly interpret unsigned EXIF IFD entry counts as signed integers. This leads to improper handling of large EXIF IFD entry counts, causing the software to attempt allocation of a memory block nearly the size of the address space. Such an allocation attempt fails and causes the process to be killed. This vulnerability allows an attacker to craft a malicious image that can terminate a worker process using libimager-perl.
Potential Impact
Successful exploitation results in denial of service by terminating the affected process handling the image. This can disrupt services or applications relying on libimager-perl for image processing. There is no indication of code execution or data corruption beyond process termination.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, avoid processing untrusted images with vulnerable versions of libimager-perl to mitigate risk.
UBUNTU-CVE-2026-14454
Description
A vulnerability in libimager-perl versions before 1.033 causes improper handling of unsigned EXIF IFD entry counts by treating them as signed integers. This mishandling can lead to an attempt to allocate an excessively large memory block, causing the process to fail and terminate. An attacker could exploit this by crafting a malicious image with specially formed EXIF data to terminate a worker process.
CVSS v3.1
Score 9.8critical
Affected software
pkg:deb/ubuntu/[email protected]+dfsg-1build1?arch=source&distro=xenialpkg:deb/ubuntu/[email protected]+dfsg-1?arch=source&distro=bionicpkg:deb/ubuntu/[email protected]+dfsg-1build1?arch=source&distro=focalpkg:deb/ubuntu/[email protected]+dfsg-2build1?arch=source&distro=jammypkg:deb/ubuntu/[email protected]+dfsg-1build2?arch=source&distro=noblepkg:deb/ubuntu/[email protected]+dfsg-1?arch=source&distro=questingpkg:deb/ubuntu/[email protected]+dfsg-1?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
libimager-perl versions prior to 1.033 incorrectly interpret unsigned EXIF IFD entry counts as signed integers. This leads to improper handling of large EXIF IFD entry counts, causing the software to attempt allocation of a memory block nearly the size of the address space. Such an allocation attempt fails and causes the process to be killed. This vulnerability allows an attacker to craft a malicious image that can terminate a worker process using libimager-perl.
Potential Impact
Successful exploitation results in denial of service by terminating the affected process handling the image. This can disrupt services or applications relying on libimager-perl for image processing. There is no indication of code execution or data corruption beyond process termination.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, avoid processing untrusted images with vulnerable versions of libimager-perl to mitigate risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-14454
- Osv Schema Version
- 1.7.0
- Aliases
- []
- Ecosystems
- ["Ubuntu:16.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:25.10","Ubuntu:26.04:LTS"]
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a58b4f568715ace43db201d
Added to database: 07/16/2026, 10:39:49 UTC
Last enriched: 07/16/2026, 14:01:28 UTC
Last updated: 07/31/2026, 19:24:47 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.