Answer in brief
CVE-2026-13708 records a High severity (CVSS 7.5) vulnerability in Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_readjpeg_wiol. The current sources do not mark it as known exploited. The current feed maps TONYC/Imager-File-JPEG (generic), TONYC/Imager::File::JPEG (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps TONYC/Imager-File-JPEG (generic), TONYC/Imager::File::JPEG (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| TONYC/Imager-File-JPEGgeneric | >=0 <1.003 | 1.003 |
| TONYC/Imager::File::JPEGgeneric | >=0 <1.003 | 1.003 |
Published upstream
Jul 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 6, 2026
Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_readjpeg_wiol. i_readjpeg_wiol walks the marker list libjpeg returns and, for each APP13 marker, allocates a new buffer with *iptc_itext = mymalloc(...) and overwrites the previous pointer without freeing it. Only the final payload is later turned into a Perl scalar and freed, so a JPEG with N such markers leaks the first N-1 payloads on every read. In a long-lived process, such as an upload or thumbnailing service, repeated reads accumulate these leaks and exhaust available memory, a denial of service. The same handler ships bundled in the Imager distribution, where versions before 1.032 are affected and the fix ships in 1.032.
Quoted source text, attributed separately from HOL analysis.