Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags. copy_string_tags() computes an ASCII EXIF tag's length as `entry->size - 1` to strip the trailing NUL. A zero-count ASCII entry sets `entry->size` to 0, and the derived length reaches i_tags_add() as -1, which is interpreted as a request to call strlen(), scanning past the entry to the next NUL and copying those bytes into the tag. JPEG reaches this path via im_decode_exif(), as does the separate Imager::File::WEBP distribution, which is fixed by upgrading Imager. Any caller of Imager->read() on an attacker-supplied image with such an entry may receive an exif_* tag holding adjacent heap bytes instead of an empty string.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4fb0f012fb advisory.

      Upstream changes (1.034):
      - Security fix: EXIF: fix decoding of ASCII fields with zero size (CVE-2026-19082, GHSA-hx46-55wp-hv6m)
      - JPEG: depend on Imager 1.034 for the EXIF decoding fix
      - Include bundled module Changes files in the main distribution
      - TIFF: fix potential seek error ignore in sizeproc



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8a61adae6f advisory.

      Upstream changes (1.034):
      - Security fix: EXIF: fix decoding of ASCII fields with zero size (CVE-2026-19082, GHSA-hx46-55wp-hv6m)
      - JPEG: depend on Imager 1.034 for the EXIF decoding fix
      - Include bundled module Changes files in the main distribution
      - TIFF: fix potential seek error ignore in sizeproc



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read     from zero-count ASCII EXIF entries in copy_string_tags. copy_string_tags() computes an ASCII EXIF tag's     length as `entry->size - 1` to strip the trailing NUL. A zero-count ASCII entry sets `entry->size` to 0,     and the derived length reaches i_tags_add() as -1, which is interpreted as a request to call strlen(),     scanning past the entry to the next NUL and copying those bytes into the tag. JPEG reaches this path via     im_decode_exif(), as does the separate Imager::File::WEBP distribution, which is fixed by upgrading     Imager. Any caller of Imager->read() on an attacker-supplied image with such an entry may receive an     exif_* tag holding adjacent heap bytes instead of an empty string. (CVE-2026-19082)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
337999	Fedora 43 : perl-Imager (2026-4fb0f012fb)	Nessus	Fedora Local Security Checks	Local	high
337891	Fedora 44 : perl-Imager (2026-8a61adae6f)	Nessus	Fedora Local Security Checks	Local	high
333381	Linux Distros Unpatched Vulnerability : CVE-2026-19082	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-19082

high

Tenable Plugins

high

high

high