Story · 1 source · 2 articlesfirst Sep 17, 22:06 UTCupdated Sep 17, 22:08 UTC (9d ago)

Four vulnerabilities disclosed in Perl's Imager image library: out-of-bounds EXIF read (CVE-2026-73638), PNG row buffer overflow (CVE-2026-73639), heap memory disclosure…

mediumVulnerabilityimportance 40CVE-2026-73639 CVE-2026-73638 CVE-2026-93019 CVE-2026-93018

What's new: Extends the previous story (written 2026-09-17), which covered only CVE-2026-73638 and CVE-2026-73639. Two additional Imager vulnerabilities were disclosed on 2026-09-18: CVE-2026-93018, an information disclosure flaw leaking uninitialized heap memory via i_gpix_p and i_glin_p with out-of-range paletted pixel indexes, and CVE-2026-93019, a denial-of-service flaw in tga_palette_read triggered by…

Merged summary · glm-5.3-flash · rewritten as coverage arrives

Stig Palmquist disclosed four vulnerabilities in Perl's Imager ecosystem on the oss-security mailing list. CVE-2026-73638 (Imager 0.45_02 through before 1.035) causes an out-of-bounds read outside the EXIF block via unchecked start offsets in tiff_load_ifd,…

Stig Palmquist disclosed four vulnerabilities in Perl's Imager image library ecosystem in two waves on the oss-security mailing list. On 2026-09-17 he reported the first pair: CVE-2026-73638, an out-of-bounds read outside the EXIF block in Imager versions 0.45_02 through before 1.035, caused by unchecked start offsets in the tiff_load_ifd function (fixed in Imager 1.035), and CVE-2026-73639, a write past the end of the row buffer in the read_direct8 function of the companion module Imager::File::PNG versions 1.003 through before 1.004, triggered when processing a PNG containing a tRNS transparency chunk (fixed in Imager::File::PNG 1.004). Report 1 explicitly notes that CVE-2026-73638 was disclosed alongside the CVE-2026-73639 flaw in the PNG reader. On 2026-09-18 he reported two further flaws, both fixed in Imager 1.036. CVE-2026-93018 is an information disclosure issue: versions before 1.036 return uninitialized heap memory through i_gpix_p and i_glin_p when a paletted image contains pixel indexes beyond its colour map, potentially leaking sensitive process memory via decoded image data. CVE-2026-93019 is a denial-of-service issue: versions before 1.036 terminate the process inside tga_palette_read when parsing a TGA file with a colour map length of 32768 or greater, allowing a crafted image to crash any application that processes untrusted files. No exploitation has been reported for the latter two flaws. The sources do not conflict.

CVE-2026-73638: affects Imager versions 0.45_02 through before 1.035; unchecked start offsets in tiff_load_ifd cause an out-of-bounds read outside the EXIF block; fixed in Imager 1.035
CVE-2026-73639: affects Imager::File::PNG versions 1.003 through before 1.004; read_direct8 writes past the end of the row buffer when reading a PNG with a tRNS transparency chunk; fixed in Imager::File::PNG 1.004
CVE-2026-93018: affects Imager versions before 1.036; uninitialized heap memory is exposed via i_gpix_p and i_glin_p when a paletted image has pixel indexes past its colour map, potentially leaking sensitive process memory via decoded…
CVE-2026-93019: affects Imager versions before 1.036; the process exits in tga_palette_read when parsing a TGA file with a colour map length of 32768 or more, causing a denial of service; fixed in Imager 1.036
All four vulnerabilities were disclosed by Stig Palmquist on the oss-security mailing list: CVE-2026-73638 and CVE-2026-73639 on 2026-09-17, CVE-2026-93018 and CVE-2026-93019 on 2026-09-18

VendorsImager

ProductsImager::File::PNG Imager

OrganizationsPerl

Coverage timelineoldest first · each row is one article

Sep 17, 22:06 UTC · 9d ago
oss-security· 35
CVE-2026-73638: Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd
Perl image library Imager before 1.035 reads outside the EXIF block via unchecked start offsets in tiff_load_ifd, fixed in 1.035.
Sep 17, 22:08 UTC · 9d ago
oss-security· 40
CVE-2026-73639: Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8
Perl module Imager::File::PNG before 1.004 writes past the end of the row buffer when reading PNGs with a tRNS transparency chunk.

Vulnerabilities in this storyAll →

CVE-2026-736386.2—
Out-of-bounds read in Perl Imager TIFF/EXIF parser (tiff_load_ifd)
published 9d ago· Imager (Perl module) Imager
CVE-2026-736399.1—
Heap buffer overflow in Imager::File::PNG Perl module when reading PNGs with tRNS chunks
published 9d ago· Imager project (CPAN) Imager::File::PNG
CVE-2026-93018

CVE	Vulnerability	CVSS	EPSS	Affected	Exposure	Published
CVE-2026-73638	Out-of-bounds read in Perl Imager TIFF/EXIF parser (tiff_load_ifd) The Imager Perl module (versions 0.45_02 through 1.034) contains an out-of-bounds read in tiff_load_ifd(): the code validates an IFD entry only by checking that offset + size stays within the EXIF block, without ever validating the entry's start offset, and integer wraparound (negative int offsets through 1.032, 32-bit size_t wrapping from 1.033, and 32-bit unsigned long wrapping of the IFD start offset, including on 64-bit Windows) allows that check to pass for entries that begin outside the block. The flaw is triggered whenever an application calls Imager->read() on an attacker-supplied image containing a crafted EXIF/TIFF structure. An attacker can cause parsed EXIF tags to contain memory bytes from outside the block (information disclosure) or crash the parsing process (denial of service). Any application or service using an affected Imager version to process untrusted images is affected. There is currently no public proof-of-concept, no known in-the-wild exploitation, and the issue is not listed in CISA KEV. Do: Upgrade to Imager 1.035 or later, which fixes the unchecked start-offset validation in tiff_load_ifd. Until patched, avoid passing untrusted image files (especially TIFF/EXIF) to Imager->read(), or restrict/sanitize image uploads upstream. No public PoC or in-the-wild exploitation is known, so immediate patching is lower urgency but still recommended for services processing third-party images.	6.2	—	Imager (Perl module) Imager 0.45_02 up to but not including 1.035 (i.e., 0.45_02 through 1.034; wraparound behavior varies by version and platform as described above)	moderateroughly 10k–100k deployments (estimate; only services that parse attacker-supplied images with Imager are exposed)	9d ago
CVE-2026-73639	Heap buffer overflow in Imager::File::PNG Perl module when reading PNGs with tRNS chunks Imager::File::PNG versions from 1.003 before 1.004 contain a heap out-of-bounds write (CWE-787) in its read_direct8() decoder when a PNG carries a tRNS transparency chunk. The function adds an alpha channel to the image it creates but still sizes the row buffer from the original channel count; because libpng expands tRNS transparency into that extra channel, png_read_row() fills one channel more than the buffer holds and writes up to width bytes past the end of the allocation. An attacker who can supply a crafted PNG to an application that decodes it via Imager->read() — for example an image-upload handler — can corrupt the heap and crash the process (denial of service); only 8-bit non-palette images are affected, since palette and 16-bit images are handled by read_paletted() and read_direct16(), which size buffers correctly. Any Perl application using the affected module, whether installed standalone or bundled inside the Imager distribution, is exposed when processing untrusted PNGs. There is no CVSS score yet, no public proof-of-concept, no CISA KEV listing, and no known exploitation in the wild. Do: Upgrade Imager::File::PNG to 1.004 or later, and apply Imager distribution updates that bundle the fixed reader. Until patched, avoid decoding untrusted or user-supplied PNGs with Imager->read(), for instance by re-encoding or validating uploads with another library. Audit code paths — especially image-upload handlers — that pass externally supplied PNG files into Imager for processing.	9.1	—	Imager project (CPAN) Imager::File::PNG >= 1.003 and < 1.004 Imager project (CPAN) Imager distribution (bundled Imager::File::PNG reader)
CVE-2026-93018	Heap Memory Disclosure in Imager Perl Module (< 1.036) via Paletted Image Parsing Imager versions before 1.036 for Perl leak uninitialised heap memory when reading paletted images that contain pixel indexes at or beyond the image's colour map. The palette is allocated uninitialised and only entries actually populated by the reader count; the TGA reader stores pixel indexes without validating them against the colour map, and the bounds handling in i_gpix_p() (which only rejects indexes greater than the count) and i_glin_p() (which silently skips out-of-range pixels) lets reads at the boundary return the first unpopulated entry, so fetching pixels or converting the image to RGB exposes prior heap contents to the caller. An attacker who can submit a crafted paletted image (e.g., a TGA file) to an application that decodes it via Imager->read() can harvest fragments of process heap memory, potentially including sensitive data held by the host application. Any application, script, or service using the Imager module before 1.036 to process untrusted images is affected. No public proof-of-concept is known, the issue is not in CISA's KEV, and no CVSS score has been assigned, with no exploitation reported to date. Do: Upgrade the Imager module to 1.036 or later via CPAN (or your OS package manager where a distribution ships it, e.g., libimager-perl). Until patched, avoid decoding untrusted paletted images — especially TGA files — or reject uploads whose pixel indexes exceed the declared colour map. Audit Perl dependency trees and image-upload pipelines to identify hosts that run Imager against user-supplied files.	5.5	—	Imager project (CPAN) Imager (Perl module) all versions before 1.036	niche
CVE-2026-93019	DoS in Perl Imager: crafted TGA colour map length triggers uncatchable process exit Imager versions before 1.036 for Perl mis-handle Truevision TGA files whose colour map length field is 32768 or greater: the two-byte length is unpacked as a signed short and becomes negative, and tga_palette_read() then casts it to size_t, producing an allocation request near SIZE_MAX. When mymalloc() cannot satisfy that request, Imager's allocator calls exit(3), terminating the entire process in a way that Perl-level exception handling cannot intercept. An attacker who can supply a crafted TGA file to any code path that calls Imager->read() — such as web image-upload processing, thumbnailing, or image-conversion services — gains a reliable remote denial-of-service with a single file. All deployments running Imager 1.035 or earlier that process externally supplied images are affected. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known, and a CVSS score has not yet been assigned. Do: Upgrade to Imager 1.036 or later, which corrects the signed length handling in tga_palette_read. As interim mitigation, reject or pre-validate TGA uploads (particularly the colour map length field) and run image parsing in a separate supervised worker process, since exit(3) cannot be caught inside the application. Audit all code paths where user-supplied files reach Imager->read() to confirm they are covered by the fix or mitigation.	9.1	—	Imager (CPAN distribution) Imager (Perl image processing module) all versions before 1.036	nichelikely thousands to tens of thousands of Perl deployments worldwide (long-standing CPAN module; exact install counts not published in the source data)