CVE-2026-13708

Name of the Vulnerable Software and Affected Versions Imager::File::JPEG versions prior to 1.003 Imager versions prior to 1.032

Description A heap memory leak occurs when reading a JPEG file containing repeated APP13 markers. The function i readjpeg wiol() iterates through the marker list provided by libjpeg and allocates a new buffer using mymalloc() for each APP13 marker, overwriting the previous pointer without freeing the memory. Consequently, only the final payload is freed, causing the first N-1 payloads to leak on every read. In long-lived processes, such as thumbnailing or upload services, these leaks can accumulate and exhaust available memory, leading to a denial of service.

Recommendations Update Imager::File::JPEG to version 1.003 or later. Update Imager to version 1.032 or later.