CVE-2026-13708 Details
Description
Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_readjpeg_wiol. i_readjpeg_wiol walks the marker list libjpeg returns and, for each APP13 marker, allocates a new buffer with *iptc_itext = mymalloc(...) and overwrites the previous pointer without freeing it. Only the final payload is later turned into a Perl scalar and freed, so a JPEG with N such markers leaks the first N-1 payloads on every read. In a long-lived process, such as an upload or thumbnailing service, repeated reads accumulate these leaks and exhaust available memory, a denial of service. The same handler ships bundled in the Imager distribution, where versions before 1.032 are affected and the fix ships in 1.032.
A memory leak vulnerability has been identified in Imager::File::JPEG versions prior to 1.003 for Perl. The issue arises when the library processes JPEG images containing multiple APP13 markers. The function i_readjpeg_wiol reads the marker list and, for each APP13 marker, allocates a new buffer for the IPTC text without freeing the previously allocated buffer. This oversight causes a heap memory leak, as only the last allocated buffer is converted into a Perl scalar and freed. In long-lived processes, such as those involving file uploads or thumbnail generation, this memory leak can accumulate, exhaust available memory, and cause a denial-of-service condition.
Users can upgrade to Imager::File::JPEG version 1.003 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 6, 2026CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tonycoz/imager/commit/9f1c485ca3ee15dc261549e11afb356866552c3a.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/TONYC/Imager-File-JPEG-1.003/source/Changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/07/06/4 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Imager::File::JPEG | < 1.003 |
CPE
Remediation
| |
| Imager | < 1.032 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | CVE Modified | CVE |
| Jul 6, 2026 | New CVE Received | CPANSec |