CVE-2026-13705: CWE-125 Out-of-bounds Read in TONYC Imager
Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle. read_rgb_16_rle guards each literal run with if (count > data_left), but count is a pixel count while every 16-bit sample consumes two bytes. The copy loop reads inp[0] * 256 + inp[1] and advances two bytes per pixel, so a run with data_left / 2 < count <= data_left passes the guard yet consumes 2 * count bytes and reads past the end of the buffer. The 8-bit path is unaffected because there one pixel is one byte. Reading a crafted SGI image through Imager->read triggers the over-read before the parser rejects the malformed image, which can crash the process.
AI Analysis
Technical Summary
TONYC Imager versions prior to 1.032 for Perl contain a heap out-of-bounds read vulnerability in the Imager::File::SGI reader component. The flaw is in the read_rgb_16_rle function, which processes 16-bit RLE literal runs. The function checks if the pixel count exceeds the remaining data length, but since each pixel consumes two bytes, the guard is insufficient. This allows the copy loop to read beyond the buffer boundary when count is greater than half but less than or equal to the remaining data bytes. The vulnerability can be triggered by processing a specially crafted SGI image, leading to a crash before the malformed image is rejected. The 8-bit processing path is not affected.
Potential Impact
The vulnerability can cause a heap out-of-bounds read resulting in a process crash when a crafted SGI image is processed. There is no evidence of code execution or data leakage from the provided information. The impact is limited to denial of service via application crash.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Users should monitor the vendor's communications for updates and avoid processing untrusted SGI images until a fix is available.
CVE-2026-13705: CWE-125 Out-of-bounds Read in TONYC Imager
Description
Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle. read_rgb_16_rle guards each literal run with if (count > data_left), but count is a pixel count while every 16-bit sample consumes two bytes. The copy loop reads inp[0] * 256 + inp[1] and advances two bytes per pixel, so a run with data_left / 2 < count <= data_left passes the guard yet consumes 2 * count bytes and reads past the end of the buffer. The 8-bit path is unaffected because there one pixel is one byte. Reading a crafted SGI image through Imager->read triggers the over-read before the parser rejects the malformed image, which can crash the process.
CVSS v3.1
Score 7.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
TONYC Imager versions prior to 1.032 for Perl contain a heap out-of-bounds read vulnerability in the Imager::File::SGI reader component. The flaw is in the read_rgb_16_rle function, which processes 16-bit RLE literal runs. The function checks if the pixel count exceeds the remaining data length, but since each pixel consumes two bytes, the guard is insufficient. This allows the copy loop to read beyond the buffer boundary when count is greater than half but less than or equal to the remaining data bytes. The vulnerability can be triggered by processing a specially crafted SGI image, leading to a crash before the malformed image is rejected. The 8-bit processing path is not affected.
Potential Impact
The vulnerability can cause a heap out-of-bounds read resulting in a process crash when a crafted SGI image is processed. There is no evidence of code execution or data leakage from the provided information. The impact is limited to denial of service via application crash.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Users should monitor the vendor's communications for updates and avoid processing untrusted SGI images until a fix is available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-06-29T13:21:04.275Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4bfce927e9c7971910b4d4
Added to database: 07/06/2026, 19:07:21 UTC
Last enriched: 07/06/2026, 19:21:46 UTC
Last updated: 07/06/2026, 19:52:08 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.