CVE-2026-73638: Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd

The Imager Perl module (versions 0.45_02 through 1.034) contains an out-of-bounds read in tiff_load_ifd(): the code validates an IFD entry only by checking that offset + size stays within the EXIF block, without ever validating the entry's start offset, and integer wraparound (negative int offsets through 1.032, 32-bit size_t wrapping from 1.033, and 32-bit unsigned long wrapping of the IFD start offset, including on 64-bit Windows) allows that check to pass for entries that begin outside the block. The flaw is triggered whenever an application calls Imager->read() on an attacker-supplied image containing a crafted EXIF/TIFF structure. An attacker can cause parsed EXIF tags to contain memory bytes from outside the block (information disclosure) or crash the parsing process (denial of service). Any application or service using an affected Imager version to process untrusted images is affected. There is currently no public proof-of-concept, no known in-the-wild exploitation, and the issue is not listed in CISA KEV.