CVE-2026-3031 | Image::EPEG versions through 0.15 for Perl embeds an unsuppo… | CVSS 9.8 CRITICAL

Description

Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library. Image::EPEG includes Epeg 0.9.0 that was last updated in 2004. Epeg is a fast JPEG thumbnail library that was once part of the Englightenment Project.

Metadata

CVE ID: CVE-2026-3031
State: PUBLISHED
Assigner: CPANSec
Reserved: 2026-02-23 14:42 UTC
Published: 2026-07-16 16:22 UTC
Last updated: 2026-07-17 18:07 UTC
Primary CWE: CWE-1104
CWE-1104 Use of Unmaintained Third Party Components
Vendor / Product: TOKUHIROM / Image::EPEG
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
TOKUHIROM	Image::EPEG	—	0 ≤ 0.15

Weakness (CWE)

CWE	Source	Description
CWE-1104	cna	CWE-1104 Use of Unmaintained Third Party Components

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (3)