Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged
Permalink CVE-2026-14454
created 1 week, 1 day ago Activity log
  • Created suggestion 1 week, 1 day ago
Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed

Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process. An attacker could craft an image with EXIF data that terminates a worker process.

Affected products

Imager
  • <1.033

Matching in nixpkgs

pkgs.usbimager

Very minimal GUI app that can write compressed disk images to USB drives

pkgs.vcdimager

Full-featured mastering suite for authoring, disassembling and analyzing Video CDs and Super Video CDs

Package maintainers