Imager versions before 1.033 for Perl mishandle unsigned EXIF IFD entry counts by treating them as signed values, causing large counts to be interpreted as negative numbers. When a crafted image with an oversized count is processed, the library attempts to allocate a memory block nearly the size of the address space; this allocation fails and terminates the process. The result is a denial‑of‑service condition without data leakage or privilege escalation. The flaw is categorized as CWE‑196 (Incorrect Handling of Unsigned Conversions) and CWE‑789 (Uncontrolled Memory Allocation).

TONYC Imager versions earlier than 1.033 on Perl. Any installation of this library that has not been upgraded to 1.033 or newer remains vulnerable.

The CVSS score of 9.8 signals a severe impact, while the EPSS score of <1% suggests a very low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the delivery of a maliciously crafted image to any service that processes images using Imager; processing the image causes the worker to crash, disabling the service without exposing sensitive data. Due to the high severity, immediate action is advised despite the low exploitation likelihood.