CVE-2026-13708

Full vulnerability record from the local CVENow database.

Description

Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_readjpeg_wiol. i_readjpeg_wiol walks the marker list libjpeg returns and, for each APP13 marker, allocates a new buffer with *iptc_itext = mymalloc(...) and overwrites the previous pointer without freeing it. Only the final payload is later turned into a Perl scalar and freed, so a JPEG with N such markers leaks the first N-1 payloads on every read. In a long-lived process, such as an upload or thumbnailing service, repeated reads accumulate these leaks and exhaust available memory, a denial of service. The same handler ships bundled in the Imager distribution, where versions before 1.032 are affected and the fix ships in 1.032.

Severity

HIGH

CVSS score

7.5 (v3.1)

Vulnerability status

Deferred

Source identifier

9b29abf9-4ab0-4765-b253-1875cd9b441e

Published

2026-07-06 13:16:32.567000

Last modified

2026-10-25 20:10:00.147000

View original CVE JSON

{
  "id": "CVE-2026-13708",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-07-06T13:16:32.567",
  "lastModified": "2026-10-25T20:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_readjpeg_wiol.\n\ni_readjpeg_wiol walks the marker list libjpeg returns and, for each APP13 marker, allocates a new buffer with *iptc_itext = mymalloc(...) and overwrites the previous pointer without freeing it. Only the final payload is later turned into a Perl scalar and freed, so a JPEG with N such markers leaks the first N-1 payloads on every read.\n\nIn a long-lived process, such as an upload or thumbnailing service, repeated reads accumulate these leaks and exhaust available memory, a denial of service.\n\nThe same handler ships bundled in the Imager distribution, where versions before 1.032 are affected and the fix ships in 1.032."
    },
    {
      "lang": "es",
      "value": "Las versiones de Imager::File::JPEG anteriores a la 1.003 para Perl fugan memoria del heap al leer un JPEG con marcadores APP13 repetidos en i_readjpeg_wiol.\n\ni_readjpeg_wiol recorre la lista de marcadores que devuelve libjpeg y, para cada marcador APP13, asigna un nuevo búfer con iptc_itext = mymalloc(...) y sobrescribe el puntero anterior sin liberarlo. Solo la carga útil final se convierte posteriormente en un escalar de Perl y se libera, por lo que un JPEG con N de estos marcadores fuga las primeras N-1 cargas útiles en cada lectura.\n\nEn un proceso de larga duración, como un servicio de carga o de creación de miniaturas, las lecturas repetidas acumulan estas fugas y agotan la memoria disponible, una denegación de servicio.\n\nEl mismo gestor se distribuye incluido en la distribución de Imager, donde las versiones anteriores a la 1.032 están afectadas y la corrección se incluye en la 1.032."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "TONYC",
          "product": "Imager::File::JPEG",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "Imager-File-JPEG",
          "programFiles": [
            "imjpeg.c"
          ],
          "programRoutines": [
            {
              "name": "i_readjpeg_wiol"
            }
          ],
          "repo": "https://github.com/tonycoz/imager",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.003",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-06T18:53:48.057324Z",
          "id": "CVE-2026-13708",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-401"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/tonycoz/imager/commit/9f1c485ca3ee15dc261549e11afb356866552c3a.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/TONYC/Imager-File-JPEG-1.003/source/Changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/07/06/4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}