Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process. An attacker could craft an image with EXIF data that terminates a worker process.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5f5efe281d advisory.

    1.033
    - CVE-2026-14454: Fix mishandling of large EXIF IFD entry count values  treated as negative numbers,     could lead to allocation failure and program exit
    - JPEG: depend on Imager 1.033 for the EXIF fix
    - Fix thread context object reference count leak in bumpmap and bumpmap_complex filters
    - TIFF: fix a leak from processing the TIFF warnings buffer (introduced in Imager 1.021)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-38f958d25a advisory.

    1.033
    - CVE-2026-14454: Fix mishandling of large EXIF IFD entry count values  treated as negative numbers,     could lead to allocation failure and program exit
    - JPEG: depend on Imager 1.033 for the EXIF fix
    - Fix thread context object reference count leak in bumpmap and bumpmap_complex filters
    - TIFF: fix a leak from processing the TIFF warnings buffer (introduced in Imager 1.021)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled     large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to     allocate a block nearly the size of the address space, which fails and kills the process. An attacker     could craft an image with EXIF data that terminates a worker process. (CVE-2026-14454)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
327221	Fedora 44 : perl-Imager (2026-5f5efe281d)	Nessus	Fedora Local Security Checks	Local	critical
327220	Fedora 43 : perl-Imager (2026-38f958d25a)	Nessus	Fedora Local Security Checks	Local	critical
325778	Linux Distros Unpatched Vulnerability : CVE-2026-14454	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-14454

critical

Tenable Plugins

critical

critical

critical