Perl Imager EXIF Integer Signedness Denial of Service

CVE-2026-14454 exploits a critical integer handling flaw in Perl's Imager library versions before 1.033, where unsigned EXIF IFD entry counts are incorrectly processed as signed integers. When an attacker crafts a malicious image with oversized EXIF metadata, the library attempts to allocate memory blocks nearly equivalent to the entire address space, causing the process to crash. This vulnerability affects any application using vulnerable Imager versions to process untrusted image files, including web services, content management systems, and image processing pipelines. With a CVSS score of 9.8, the critical severity reflects the ease of exploitation and severe impact: attackers can achieve reliable denial of service against worker processes with minimal effort.

While CVE-2026-14454 does not map directly to MITRE ATT&CK techniques, Casky's Claude-powered analysis framework would identify this attack through CWE-196 (Unsigned to Signed Conversion Error) and CWE-789 (Memory Allocation with Excessive Size Value) detection patterns. Practitioners using Casky would observe findings related to unsafe integer type conversions in image parsing code paths and suspicious memory allocation requests that exceed reasonable bounds. Extended reasoning across Casky's security skills would flag the characteristic denial-of-service signature: crafted binary inputs triggering resource exhaustion without requiring privilege escalation or code execution. Security teams would detect this attack pattern during application security reviews and runtime monitoring of image processing operations, enabling rapid identification of vulnerable Imager deployments before malicious images reach production systems.