A heap memory leak occurs when Imager::File::JPEG module parses JPEG APP13 markers. With each APP13 marker the code the N-1 payloads remain a long memory, culminating in application crash or refusal to service requests. The underlying weakness is a classic memory leak (CWE‑401).

The flaw affects Perl applications that use the TONYC Imager::File::JPEG module, specifically versions earlier than 1.003, and the bundled Imager distribution before 1.032. Any service that uploads, processes, or thumbnails JPEG images—such as web upload handlers, content management systems, or image-processing microservices is potentially impacted.

With a CVSS score of 7.5, the vulnerability is considered high severity. The EPSS score of < 1% indicates a very low exploitation probability, though not zero. The nature of the flaw to trigger the memory leak by submitting JPEG files containing a large number of APP13 markers to a vulnerable service. The likely attack vector is remote file upload, and the prerequisite is that the service uses the affected module and does not filter input. The vulnerability is not listed in the CISA KEV catalog, but the ability to exhaust memory in continuously running processes makes it a significant risk.