CVE-2026-125180

FFmpeg versions 8.1 through 9.0.2 are vulnerable to a memory exhaustion vulnerability within the libavcodec/exif.c parser. The root cause is the parser's ability to be manipulated by pointing multiple IFD entries at overlapping payloads, which allows an attacker to trigger quadratic memory alloca...

CVE-2026-73638: Out-of-bounds Read

Imager versions from 0.4502 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiffloadifd. tiffloadifd validates an IFD entry's data by checking that entry-offset + entry-size stays within the EXIF block, and never checks the start offset itself. Where that sum is n...