CVE-2026-93019 PUBLISHED

Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read

Assigner: CPANSec
Reserved: 17.09.2026 Published: 18.09.2026 Updated: 18.09.2026

Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read.

The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tga_palette_read() casts that value to size_t and asks mymalloc() for a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3).

Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.

Product Status

Package Collection https://cpan.org/modules
Package Name Imager
Versions Default: unaffected
  • affected from 0 to 1.036 (excl.)

Solutions

Upgrade to Imager 1.036 or later.

Credits

  • router0mail finder

References

Problem Types

  • CWE-196 Unsigned to Signed Conversion Error CWE
  • CWE-789 Memory Allocation with Excessive Size Value CWE