Threats affecting pkg:cpan/Imager

Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected. The same code ships bundled in the Imager distribution. An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.

CVE-2026-102505 is a medium severity vulnerability in Imager versions before 1.037 for Perl. It involves an incorrect calculation of buffer size when fetching float samples from a paletted image, leading to a heap buffer overflow. Specifically, requesting more than one channel causes writes past the allocated buffer end, controlled by attacker-supplied image palette data.

CVE-2026-102504 affects Imager for Perl versions before 1.037. The vulnerability arises from improper handling of the raw_datachannels value in the i_readraw_wiol function, which lacks range checking. This can cause the program to request an excessive memory allocation, leading to process termination via an uncatchable exit call when allocation fails.

CVE-2026-93019 is a critical vulnerability in Perl's Imager module versions before 1.036. It arises from an unsigned to signed conversion error when reading TGA image files with a color map length of 32768 or more. This causes the process to exit abruptly and uncatchably during image reading.

Imager versions before 1.036 for Perl contain a vulnerability where reading a paletted image with pixel indexes beyond the color map causes uninitialized heap memory disclosure. The palette is allocated without initialization, and pixel indexes equal to the palette size read unpopulated entries, leaking prior heap contents. This occurs when reading attacker-supplied images and then fetching pixels or converting them to RGB.

CVE-2026-73639 is a critical out-of-bounds write vulnerability in the Imager Perl module's PNG file reader. Versions from 1.003 before 1.004 and 1.034 before 1.035 improperly size the row buffer when reading PNG images with a tRNS transparency chunk, causing heap corruption and potential process crashes.

A vulnerability in Imager for Perl versions from 0.45_02 up to but not including 1.035 allows an out-of-bounds read in the EXIF processing code. The flaw arises because the start offset of an IFD entry is not properly validated, enabling reads outside the intended EXIF block. This can cause the process to crash or return data from outside the EXIF block when reading attacker-supplied images.