Imager versions before 1.033 treat unsigned EXIF IFD entry counts as signed values, causing negative counts. A malicious image with an oversized EXIF count triggers the library to attempt to allocate a memory block nearly the size of the address space, which fails and terminates the process. This crash results in a denial‑of‑service condition without leaking data or escalating privileges. The flaw is categorized as CWE‑196 and CWE‑789.

The TONYC 1.033. Any installation of this library prior to that version is potentially vulnerable until it is upgraded or another fix is applied.

The CVSS score of 9.8 indicates a severe impact, while the EPSS score of <1% suggests a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. A likely attack vector is the delivery of a crafted image to any service that processes images via Imager; the resulting crash disables the worker but does not expose sensitive data. Despite the low likelihood, the high severity warrants proactive mitigation.