Libimager perl: Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in… (CVE-2026-73639)

Imager::File::PNG versions from 1.003 before 1.004 for Perl improperly handle PNG images with a tRNS transparency chunk in the read_direct8() function. The function adds an alpha channel but sizes the row buffer based on the original channel count, leading to a buffer overflow when libpng expands the transparency into the extra channel. This results in writing width bytes past the allocated buffer, causing heap corruption. The vulnerability affects the bundled PNG reader in the Imager distribution and can be triggered by processing attacker-supplied PNG images.

An attacker can supply a specially crafted PNG image with a tRNS transparency chunk that triggers a heap buffer overflow in the vulnerable Imager::File::PNG versions. This overflow can corrupt the heap and cause the process to crash, leading to denial of service. The CVSS score of 9.1 indicates a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates and avoid processing untrusted PNG images with affected versions until a fix is available.