CVE-2026-73638: Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd
Perl image library Imager before 1.035 reads outside the EXIF block via unchecked start offsets in tiff_load_ifd, fixed in 1.035.
CVE-2026-73638 affects Imager versions 0.45_02 through before 1.035 for Perl. The flaw is an out-of-bounds read outside the EXIF block caused by unchecked start offsets in the tiff_load_ifd function. It was disclosed on the oss-security mailing list by Stig Palmquist alongside CVE-2026-73639, with the fix available in version 1.035.
- Affects Imager versions 0.45_02 through before 1.035
- Unchecked start offsets in tiff_load_ifd cause out-of-bounds read
- Fix available in version 1.035
- Disclosed alongside CVE-2026-73639 in the PNG reader
- CVEs
- CVE-2026-73638
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-73638 | Out-of-bounds read in Perl Imager TIFF/EXIF parser (tiff_load_ifd) | 6.2 | — |
From the original article
Posted by Stig Palmquist on Sep 17 ======================================================================== https://metacpan. org/dist/Imager https://github. com/tonycoz/imager Imager versions from 0.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.