CVE-2026-93019: Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read

Imager versions before 1.036 for Perl mis-handle Truevision TGA files whose colour map length field is 32768 or greater: the two-byte length is unpacked as a signed short and becomes negative, and tga_palette_read() then casts it to size_t, producing an allocation request near SIZE_MAX. When mymalloc() cannot satisfy that request, Imager's allocator calls exit(3), terminating the entire process in a way that Perl-level exception handling cannot intercept. An attacker who can supply a crafted TGA file to any code path that calls Imager->read() — such as web image-upload processing, thumbnailing, or image-conversion services — gains a reliable remote denial-of-service with a single file. All deployments running Imager 1.035 or earlier that process externally supplied images are affected. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known, and a CVSS score has not yet been assigned.