CVE-2026-93018
UnknownSummary
Imager versions before 1.036 for Perl disclose uninitialised heap memory when reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p. The palette is allocated uninitialised, and the TGA reader stores pixel indexes without checking them against the colour map, allowing reads of prior heap contents.
Risk Assessment
Reading an attacker-supplied image and then fetching its pixels or converting it to RGB discloses process heap memory, potentially leading to leakage of sensitive data.
Recommendation
Upgrade the Imager library for Perl to version 1.036 or later. Until patched, avoid reading and converting untrusted paletted images.
Other vulnerabilities in Imager
See all- CVE-2026-93019Critical
Imager versions before 1.036 for Perl exit the process when reading a TGA file with a colour map length of 32768 or more in tga_palette_read. The two-byte length is unpacked into a signed short, so 32768 or more becomes negative, then cast to size_t, causing mymalloc() to request a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3).
- CVE-2026-14454Critical
The vulnerability in the Imager library for Perl before version 1.033 mishandles unsigned EXIF IFD entry counts as signed, potentially leading to an attempt to allocate a huge memory block and process crash. An attacker can exploit this by crafting an image with malicious EXIF data to terminate a worker process.
- CVE-2026-73638Low risk· EPSS 7%
Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd. tiff_load_ifd() validates an IFD entry's data by checking that entry->offset + entry->size stays within the EXIF block, and never checks the start offset itself. Where that sum is not the real end of the data, the check passes with the entry starting outside the block. Through 1.032 entry->offset is a plain int, so on the usual two's-complement implementations an offset with the high bit set converts to negative and the sum can land back inside the block. From 1.033 the field is a size_t and the addition wraps only where size_t is 32 bits. The IFD's own start offset is checked the same way and wraps where unsigned long is 32 bits, which includes 64-bit Windows. Any caller of Imager->read() on an attacker-supplied image may receive EXIF tags holding bytes from outside the block, or crash the process.
- CVE-2026-19082High
Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags. An attacker can supply an image with such an entry, leading to heap data leakage into the exif_* tag.
- CVE-2026-13705High
In the Imager library for Perl before version 1.032, there is a heap out-of-bounds read vulnerability in the Imager::File::SGI module. The issue is in the read_rgb_16_rle function, which incorrectly checks the pixel count in an RLE run, leading to a read past the buffer. An attacker can exploit this by providing a crafted SGI image, potentially causing a process crash.
Original NVD description (English source)
Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without checking them against the colour map. i_gpix_p() rejects only an index greater than the count, so an index equal to it reads the first unpopulated entry, and getpixel() returns it. i_glin_p() skips any index at or beyond the count without writing that pixel to the caller's buffer. The palette-to-RGB conversion reads each row through an uninitialised buffer, so those pixels of the converted image hold prior heap contents. Reading an attacker-supplied image through Imager->read() and then fetching its pixels or converting it to RGB discloses process heap memory.