CVE-2026-93019: critical vulnerability in Imager
Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.1epss 0.7%
Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read.
The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tga_palette_read() casts that value to size_t and asks mymalloc() for a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3).
Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected products
ImagerRelated CVEs — Imager
In the same product, most dangerous first.
CVE-2026-73639CRITICALImager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8EPSS 0.7%CVE-2026-112202MEDIUMImager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF imagesEPSS 0.4%CVE-2026-102504HIGHImager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiolEPSS 0.4%CVE-2026-102505MEDIUMImager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fpEPSS 0.2%CVE-2026-73638MEDIUMImager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifdEPSS 0.2%CVE-2026-93018MEDIUMImager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_pEPSS 0.2%