A heap memory leak occurs when the Imager::File::JPEG module parses JPEG APP13 markers. With each APP13 marker the code allocates a new buffer and overwrites the previous pointer without freeing it, so the first N‑1 payloads persist. Over many repeated reads of files containing many markers, the accumulated leak consumes available memory, leading to application crashes or refusals to service requests. The underlying weakness is a classic memory leak (CWE‑401).

The flaw affects Perl applications that use the TONYC Imager::File::JPEG module, specifically versions earlier than 1.003, and the bundled Imager distribution before 1.032. Any service that uploads, processes, or thumbnails JPEG images—such as web upload handlers, content management systems, or image-processing microservices—is potentially impacted.

With a CVSS score of 7.5, the vulnerability is considered high severity. The EPSS score of <1% indicates a very low exploitation probability, though not zero. The flaw can be triggered by submitting JPEG files that contain a large number of APP13 markers to a vulnerable service. The likely attack vector is remote file upload, and the prerequisite is that the service uses the affected module and does not filter input. The vulnerability is not listed in the CISA KEV catalog, but the ability to exhaust memory in continuously running processes makes it a significant risk.