CVE-2026-112202: CWE-125 Out-of-bounds Read

Imager::File::GIF versions prior to 1.006 for Perl contain an out-of-bounds read vulnerability (CWE-125) when consolidating GIF images with the gif_consolidate option enabled. The vulnerability arises because palette indices from the image are used without bounds checking against the color table, causing the i_readgif_low routine to read beyond the allocated heap memory and copy those bytes into output pixels. This can result in disclosure of adjacent heap memory and may cause the process to crash. The default GIF reader is unaffected. The vulnerable code is also included in the Imager distribution.

An attacker who supplies a specially crafted GIF image with the gif_consolidate option enabled can cause the application to read beyond allocated heap memory. This may lead to disclosure of adjacent heap memory contents, potentially leaking sensitive information, and can also cause the process to crash, resulting in denial of service.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid enabling the gif_consolidate option when processing untrusted GIF images or apply other application-level mitigations to restrict or sanitize input.