Four vulnerabilities disclosed in Perl's Imager image library: out-of-bounds EXIF read (CVE-2026-73638), PNG row buffer overflow (CVE-2026-73639), heap memory disclosure…

Stig Palmquist disclosed four vulnerabilities in Perl's Imager ecosystem on the oss-security mailing list. CVE-2026-73638 (Imager 0.45_02 through before 1.035) causes an out-of-bounds read outside the EXIF block via unchecked start offsets in tiff_load_ifd,…

Stig Palmquist disclosed four vulnerabilities in Perl's Imager image library ecosystem in two waves on the oss-security mailing list. On 2026-09-17 he reported the first pair: CVE-2026-73638, an out-of-bounds read outside the EXIF block in Imager versions 0.45_02 through before 1.035, caused by unchecked start offsets in the tiff_load_ifd function (fixed in Imager 1.035), and CVE-2026-73639, a write past the end of the row buffer in the read_direct8 function of the companion module Imager::File::PNG versions 1.003 through before 1.004, triggered when processing a PNG containing a tRNS transparency chunk (fixed in Imager::File::PNG 1.004). Report 1 explicitly notes that CVE-2026-73638 was disclosed alongside the CVE-2026-73639 flaw in the PNG reader. On 2026-09-18 he reported two further flaws, both fixed in Imager 1.036. CVE-2026-93018 is an information disclosure issue: versions before 1.036 return uninitialized heap memory through i_gpix_p and i_glin_p when a paletted image contains pixel indexes beyond its colour map, potentially leaking sensitive process memory via decoded image data. CVE-2026-93019 is a denial-of-service issue: versions before 1.036 terminate the process inside tga_palette_read when parsing a TGA file with a colour map length of 32768 or greater, allowing a crafted image to crash any application that processes untrusted files. No exploitation has been reported for the latter two flaws. The sources do not conflict.