CVE-2026-93019

Imager versions before 1.036 for Perl mis-handle Truevision TGA files whose colour map length field is 32768 or greater: the two-byte length is unpacked as a signed short and becomes negative, and tga_palette_read() then casts it to size_t, producing an allocation request near SIZE_MAX. When mymalloc() cannot satisfy that request, Imager's allocator calls exit(3), terminating the entire process in a way that Perl-level exception handling cannot intercept. An attacker who can supply a crafted TGA file to any code path that calls Imager->read() — such as web image-upload processing, thumbnailing, or image-conversion services — gains a reliable remote denial-of-service with a single file. All deployments running Imager 1.035 or earlier that process externally supplied images are affected. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known, and a CVSS score has not yet been assigned.

What to do: Upgrade to Imager 1.036 or later, which corrects the signed length handling in tga_palette_read. As interim mitigation, reject or pre-validate TGA uploads (particularly the colour map length field) and run image parsing in a separate supervised worker process, since exit(3) cannot be caught inside the application. Audit all code paths where user-supplied files reach Imager->read() to confirm they are covered by the fix or mitigation.