CVE-2026-93019: Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read
CVE-2026-93019: Imager for Perl versions before 1.036 exit the process when reading a TGA image with a colour map length of 32768 or more.
Stig Palmquist disclosed CVE-2026-93019, a denial-of-service flaw in the Imager image library for Perl. Versions before 1.036 terminate the process inside tga_palette_read when parsing a TGA file with a colour map length of 32768 or greater, allowing a crafted image to crash any application that processes untrusted files. The issue is fixed in Imager 1.036; no exploitation has been reported.
- Affects all Imager versions before 1.036
- Crash occurs in tga_palette_read when parsing oversized TGA colour maps
- No exploitation reported; fixed in Imager 1.036
- CVEs
- CVE-2026-93019
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-93019 | DoS in Perl Imager: crafted TGA colour map length triggers uncatchable process exit | 9.1 | — |
From the original article
Posted by Stig Palmquist on Sep 18 ======================================================================== https://metacpan. org/dist/Imager https://github. com/tonycoz/imager Imager versions before 1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.