CVE-2026-73639: Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8

Imager::File::PNG versions from 1.003 before 1.004 contain a heap out-of-bounds write (CWE-787) in its read_direct8() decoder when a PNG carries a tRNS transparency chunk. The function adds an alpha channel to the image it creates but still sizes the row buffer from the original channel count; because libpng expands tRNS transparency into that extra channel, png_read_row() fills one channel more than the buffer holds and writes up to width bytes past the end of the allocation. An attacker who can supply a crafted PNG to an application that decodes it via Imager->read() — for example an image-upload handler — can corrupt the heap and crash the process (denial of service); only 8-bit non-palette images are affected, since palette and 16-bit images are handled by read_paletted() and read_direct16(), which size buffers correctly. Any Perl application using the affected module, whether installed standalone or bundled inside the Imager distribution, is exposed when processing untrusted PNGs. There is no CVSS score yet, no public proof-of-concept, no CISA KEV listing, and no known exploitation in the wild.