CVE-2026-93019: fallo crítico en Imager
Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.1epss 0.7%
Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read.
The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tga_palette_read() casts that value to size_t and asks mymalloc() for a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3).
Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Productos afectados
ImagerCVEs relacionadas — Imager
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-73639CRITICALImager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8EPSS 0.7%CVE-2026-112202MEDIUMImager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF imagesEPSS 0.4%CVE-2026-102504HIGHImager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiolEPSS 0.4%CVE-2026-102505MEDIUMImager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fpEPSS 0.2%CVE-2026-73638MEDIUMImager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifdEPSS 0.2%CVE-2026-93018MEDIUMImager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_pEPSS 0.2%