Heap Memory Disclosure in Imager Perl Module (< 1.036) via Paletted Image Parsing
Imager versions before 1.036 for Perl leak uninitialised heap memory when reading paletted images that contain pixel indexes at or beyond the image's colour map. The palette is allocated uninitialised and only entries actually populated by the reader count; the TGA reader stores pixel indexes without validating them against the colour map, and the bounds handling in i_gpix_p() (which only rejects indexes greater than the count) and i_glin_p() (which silently skips out-of-range pixels) lets reads at the boundary return the first unpopulated entry, so fetching pixels or converting the image to RGB exposes prior heap contents to the caller. An attacker who can submit a crafted paletted image (e.g., a TGA file) to an application that decodes it via Imager->read() can harvest fragments of process heap memory, potentially including sensitive data held by the host application. Any application, script, or service using the Imager module before 1.036 to process untrusted images is affected. No public proof-of-concept is known, the issue is not in CISA's KEV, and no CVSS score has been assigned, with no exploitation reported to date.
What to do: Upgrade the Imager module to 1.036 or later via CPAN (or your OS package manager where a distribution ships it, e.g., libimager-perl). Until patched, avoid decoding untrusted paletted images — especially TGA files — or reject uploads whose pixel indexes exceed the declared colour map. Audit Perl dependency trees and image-upload pipelines to identify hosts that run Imager against user-supplied files.
| Product | Affected |
|---|---|
| Imager project (CPAN) Imager (Perl module) | all versions before 1.036 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without checking them against the colour map. i_gpix_p() rejects only an index greater than the count, so an index equal to it reads the first unpopulated entry, and getpixel() returns it. i_glin_p() skips any index at or beyond the count without writing that pixel to the caller's buffer. The palette-to-RGB conversion reads each row through an uninitialised buffer, so those pixels of the converted image hold prior heap contents. Reading an attacker-supplied image through Imager->read() and then fetching its pixels or converting it to RGB discloses process heap memory.
CVE-2026-93018: Imager for Perl versions before 1.036 disclose uninitialized heap memory when reading paletted images with pixel indexes past the colour map.
Today 1.6K readers · 2.5K views · 779 reads · all time 189K views