Heap buffer overflow in Imager::File::PNG Perl module when reading PNGs with tRNS chunks
AI analysis
Imager::File::PNG versions from 1.003 before 1.004 contain a heap out-of-bounds write (CWE-787) in its read_direct8() decoder when a PNG carries a tRNS transparency chunk. The function adds an alpha channel to the image it creates but still sizes the row buffer from the original channel count; because libpng expands tRNS transparency into that extra channel, png_read_row() fills one channel more than the buffer holds and writes up to width bytes past the end of the allocation. An attacker who can supply a crafted PNG to an application that decodes it via Imager->read() — for example an image-upload handler — can corrupt the heap and crash the process (denial of service); only 8-bit non-palette images are affected, since palette and 16-bit images are handled by read_paletted() and read_direct16(), which size buffers correctly. Any Perl application using the affected module, whether installed standalone or bundled inside the Imager distribution, is exposed when processing untrusted PNGs. There is no CVSS score yet, no public proof-of-concept, no CISA KEV listing, and no known exploitation in the wild.
What to do: Upgrade Imager::File::PNG to 1.004 or later, and apply Imager distribution updates that bundle the fixed reader. Until patched, avoid decoding untrusted or user-supplied PNGs with Imager->read(), for instance by re-encoding or validating uploads with another library. Audit code paths — especially image-upload handlers — that pass externally supplied PNG files into Imager for processing.
Affected
| Imager project (CPAN) Imager::File::PNG | >= 1.003 and < 1.004 |
| Imager project (CPAN) Imager distribution (bundled Imager::File::PNG reader) | — |
Estimated exposure
nicheunknown; plausibly at most tens of thousands of Perl deployments (niche CPAN imaging module with no public install telemetry) — CPAN does not publish active-install counts and no public scan data exist for this module, so the estimate rests on Imager::File::PNG being a specialized server-side Perl image-processing dependency rather than a mass-market product.
Description
Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8. With a tRNS chunk, read_direct8() adds an alpha channel to the image it creates but still sizes the row buffer from the original channel count. libpng expands the transparency into that extra channel, so png_read_row() fills one channel more than the buffer holds, at one byte per sample, and writes width bytes past the end of the allocation. Palette images go to read_paletted() and 16-bit images to read_direct16(), which sizes its buffer from png_get_rowbytes() and allocates enough for the expanded row. The same reader ships bundled in the Imager distribution. Reading an attacker-supplied PNG through Imager->read() corrupts the heap, which can crash the process.