CVE-2026-14454
Tonycoz Imager ≤ 1.033
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-14454 is a critical-severity Unsigned to Signed Conversion Error (CWE-196) vulnerability in Tonycoz Imager. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 30th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-42226
Vulnerability Data
Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size…
more
of the address space, which fails and kills the process. An attacker could craft an image with EXIF data that terminates a worker process.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover unsigned-to-signed conversion errors through targeted test cases or analysis.
Input validation directly rejects or bounds untrusted size values before any allocation occurs.
Requiring documented development standards and tools can mandate safe integer handling and prohibit unsafe casts.
Security engineering principles can include explicit rules for safe type conversion and arithmetic operations.
Resource quotas and priority allocation limit the system-wide impact of an oversized request.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices (reviews, static analysis, safe integer handling) directly prevent unsigned-to-signed conversion errors during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect integer conversion errors through static analysis and fuzzing.
Secure development lifecycle mandates practices that can catch or prevent unsafe type conversions.
Application security requirements can specify safe handling of numeric types and bounds checking.
Secure architecture principles include choosing appropriate data types and avoiding implicit conversions.
Secure coding standards directly address avoiding unsafe casts from unsigned to signed integers.
Capacity management monitors overall resource use but does not prevent individual allocation bugs.