Libimager perl: Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd. (CVE-2026-73638)

The vulnerability in libimager-perl affects versions from 0.45_02 before 1.035. The function tiff_load_ifd validates an IFD entry's data by ensuring that the sum of entry->offset and entry->size remains within the EXIF block, but it does not validate the start offset itself. Due to this, entries starting outside the EXIF block can pass validation if the sum falls within the block. The offset field was an int through version 1.032, allowing negative values on two's complement systems, and changed to size_t in 1.033, affecting how wrapping occurs on 32-bit systems. This flaw allows reading bytes outside the EXIF block or crashing the process when Imager->read() processes crafted images.

An attacker supplying a malicious image to Imager->read() may cause the application to read memory outside the intended EXIF block, potentially leaking memory contents or causing a denial of service via process crash. There is no indication of confidentiality or integrity impact beyond this memory read and crash.

No explicit patch or fix is stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted images with vulnerable versions of libimager-perl.