CVE-2026-93018 affects Imager for Perl versions prior to 1.036. The vulnerability arises from the use of uninitialized resources when reading paletted images with pixel indexes that are equal to the size of the color map. The palette is allocated without initialization, and the TGA image reader does not validate pixel indexes against the color map size properly. Specifically, the i_gpix_p() function rejects only indexes greater than the count, allowing an index equal to the count to read uninitialized palette entries. The i_glin_p() function skips indexes at or beyond the count without writing pixels, but the palette-to-RGB conversion reads from an uninitialized buffer, causing pixels in the converted image to contain prior heap memory contents. This leads to disclosure of process heap memory when an attacker supplies a malicious image and then accesses pixel data or converts the image to RGB.

An attacker can cause the application to disclose uninitialized heap memory by supplying a crafted paletted image with pixel indexes equal to the color map size. This memory disclosure can reveal sensitive information from the process heap, potentially exposing data that should remain confidential. There is no indication of code execution or other impacts beyond information disclosure.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted paletted images with Imager versions before 1.036 or implement input validation to reject images with pixel indexes equal to or exceeding the color map size.