TI-2026-11557 Aliases CVE-2026-13708 GHSA-cx44-fgg3-fcp4

Memory leak in TONYC Imager::File::JPEG

MEDIUM 40CWE-401Published 2026-07-06 · Updated 2026-07-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-401.

Summary

Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_readjpeg_wiol. i_readjpeg_wiol walks the marker list libjpeg returns and, for each APP13 marker, allocates a new buffer with *iptc_itext = mymalloc(...) and overwrites the previous pointer without freeing it. Only the final payload is later turned into a Perl scalar and freed, so a JPEG with N such markers leaks the first N-1 payloads on every read. In a long-lived process, such as an upload or thumbnailing service, repeated reads accumulate these leaks and exhaust available memory, a denial of service. The same handler ships bundled in the Imager distribution, where versions before 1.032 are affected and the fix ships in 1.032.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00609 49th percentileScored 2026-11-07

Fix Fixed Imager::File::JPEG (TONYC): 1.003

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TONYC	Imager::File::JPEG	before 1.003	1.003	Patch available	CNA

Imager::File::JPEG VendorTONYC Affected before 1.003 Fixed in 1.003 Patch available CNA

Remediation

Fix · CNA Imager::File::JPEG (TONYC) Fixed in 1.003

Timeline

2026-10-02 Threatist record created from CVE-2026-13708
2026-10-03 Alias added: GHSA-cx44-fgg3-fcp4

References

Patch 1

https://github.com/tonycoz/imager/commit/9f1c485ca3ee15dc261549e11afb356866552c3a.patch

Other 1

https://metacpan.org/release/TONYC/Imager-File-JPEG-1.003/source/Changes

TI-2026-15600 Out-of-bounds read in TONYC Imager CVSS 3.1HIGH 7.5
TI-2026-12218 Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed CVSS 3.1CRITICAL 9.8
TI-2026-07618 Out-of-bounds write in TONYC Imager CVSS 3.1MEDIUM 6.5
TI-2026-11554 Out-of-bounds read in TONYC Imager CVSS 3.1HIGH 7.1
TI-2026-07428 Out-of-bounds write in TONYC Imager::File::GIF CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences