CVE-2026-102504

Imager versions before 1.036 for Perl exit the process when reading a TGA file with a colour map length of 32768 or more in tga_palette_read. The two-byte length is unpacked into a signed short, so 32768 or more becomes negative, then cast to size_t, causing mymalloc() to request a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3).

The vulnerability in the Imager library for Perl before version 1.033 mishandles unsigned EXIF IFD entry counts as signed, potentially leading to an attempt to allocate a huge memory block and process crash. An attacker can exploit this by crafting an image with malicious EXIF data to terminate a worker process.

Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every requested channel of each pixel into it. Requesting more than one channel writes past its end. An attacker-supplied image controls the overflowing bytes through its palette.

Imager versions before 1.036 for Perl disclose uninitialised heap memory when reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p. The palette is allocated uninitialised, and the TGA reader stores pixel indexes without checking them against the colour map, allowing reads of prior heap contents.

Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd. tiff_load_ifd() validates an IFD entry's data by checking that entry->offset + entry->size stays within the EXIF block, and never checks the start offset itself. Where that sum is not the real end of the data, the check passes with the entry starting outside the block. Through 1.032 entry->offset is a plain int, so on the usual two's-complement implementations an offset with the high bit set converts to negative and the sum can land back inside the block. From 1.033 the field is a size_t and the addition wraps only where size_t is 32 bits. The IFD's own start offset is checked the same way and wraps where unsigned long is 32 bits, which includes 64-bit Windows. Any caller of Imager->read() on an attacker-supplied image may receive EXIF tags holding bytes from outside the block, or crash the process.

Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags. An attacker can supply an image with such an entry, leading to heap data leakage into the exif_* tag.

In the Imager library for Perl before version 1.032, there is a heap out-of-bounds read vulnerability in the Imager::File::SGI module. The issue is in the read_rgb_16_rle function, which incorrectly checks the pixel count in an RLE run, leading to a read past the buffer. An attacker can exploit this by providing a crafted SGI image, potentially causing a process crash.