CVE-2026-13705
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Imager library for Perl before version 1.032, there is a heap out-of-bounds read vulnerability in the Imager::File::SGI module. The issue is in the read_rgb_16_rle function, which incorrectly checks the pixel count in an RLE run, leading to a read past the buffer. An attacker can exploit this by providing a crafted SGI image, potentially causing a process crash.
Risk Assessment
The risk involves the possibility of remotely causing a crash in applications using the Imager library to process SGI images. This can lead to Denial of Service and potentially the leakage of sensitive data from memory.
Recommendation
Immediately update the Imager library to version 1.032 or later. If an update is not possible, restrict processing of SGI images to trusted sources only.
Original NVD description (English source)
Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle. read_rgb_16_rle guards each literal run with if (count > data_left), but count is a pixel count while every 16-bit sample consumes two bytes. The copy loop reads inp[0] * 256 + inp[1] and advances two bytes per pixel, so a run with data_left / 2 < count <= data_left passes the guard yet consumes 2 * count bytes and reads past the end of the buffer. The 8-bit path is unaffected because there one pixel is one byte. Reading a crafted SGI image through Imager->read triggers the over-read before the parser rejects the malformed image, which can crash the process.