CVE-2026-3031
The vulnerability is in the Perl module Image::EPEG, which bundles an old, unsupported JPEG thumbnail library. The flaw allows an attacker to read, modify, or delete data processed by the module, potentially compromising the entire application. The issue exists in all versions up to 0.15.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Perl developers using the Image::EPEG module, versions 0.15 and earlier, which includes the outdated Epeg 0.9.0 library.
Real-world impact
An attacker could read, modify, or delete any data that the application processes through Image::EPEG, effectively taking full control of the application’s data handling.
Why this severity
The CVSS score of 9.8 reflects that the flaw can be exploited remotely without authentication, with no user interaction, and can lead to complete compromise of confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources