CVE-2026-93019: falha crítica em Imager
Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.7%
Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read.
The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tga_palette_read() casts that value to size_t and asks mymalloc() for a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3).
Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Produtos afetados
ImagerCVEs relacionadas — Imager
No mesmo produto, das mais perigosas para as menos.
CVE-2026-73639CRITICALImager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8EPSS 0.7%CVE-2026-112202MEDIUMImager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF imagesEPSS 0.4%CVE-2026-102504HIGHImager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiolEPSS 0.4%CVE-2026-102505MEDIUMImager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fpEPSS 0.2%CVE-2026-73638MEDIUMImager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifdEPSS 0.2%CVE-2026-93018MEDIUMImager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_pEPSS 0.2%