Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitylow

Imager for Perl before 1.036: heap memory disclosure (CVE-2026-93018) and TGA parsing process exit (CVE-2026-93019)

1 source · 2 articlesFirst reported Updated ()2 · 1 read
What's new

This is the first merged summary; it consolidates two oss-security reports published 2026-09-18 disclosing CVE-2026-93018 and CVE-2026-93019 in Imager for Perl, both fixed in version 1.036. The two reports do not disagree on any facts.

Merged summary · glm-5.3 · rewritten as coverage arrivesSummaries by Vani AI

Two flaws in the Imager image library for Perl, versions before 1.036, disclose uninitialized heap memory via paletted images (CVE-2026-93018) and crash the process via crafted TGA colour maps of length 32768 or more (CVE-2026-93019); both are fixed in Imager…

Stig Palmquist disclosed two vulnerabilities in the Imager image library for Perl, published on oss-security on 2026-09-18. CVE-2026-93018 is an information disclosure flaw: versions before 1.036 return uninitialized heap memory through the i_gpix_p and i_glin_p functions when reading a paletted image containing pixel indexes beyond its colour map, potentially leaking sensitive process memory via decoded image data. CVE-2026-93019 is a denial-of-service flaw: versions before 1.036 terminate the process inside tga_palette_read when parsing a TGA file with a colour map length of 32768 or greater, allowing a crafted image to crash any application that processes untrusted files. Both issues are fixed in Imager 1.036, and no exploitation has been reported for either vulnerability.

Key facts
  • CVE-2026-93018: information disclosure in Imager for Perl versions before 1.036
  • CVE-2026-93018 exposes uninitialized heap memory via i_gpix_p and i_glin_p when a paletted image contains pixel indexes past its colour map
  • CVE-2026-93019: denial of service in Imager for Perl versions before 1.036
  • CVE-2026-93019 causes process exit in tga_palette_read when parsing a TGA file with a colour map length of 32768 or more
  • Both vulnerabilities were disclosed by Stig Palmquist on oss-security on 2026-09-18
  • Both issues are fixed in Imager 1.036
  • No exploitation has been reported for either vulnerability
Analyze CVE-2026-93018 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-93019CVE-2026-93018
Vendors
Imager
Products
Imager

Coverage

oldest first · one row per article · UTC
  1. · Sep 18, 2026 oss-securityFirst report

    CVE-2026-93018: Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p

    CVE-2026-93018: Imager for Perl versions before 1.036 disclose uninitialized heap memory when reading paletted images with pixel indexes past the colour map.

  2. · Sep 18, 2026 oss-security

    CVE-2026-93019: Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read

    CVE-2026-93019: Imager for Perl versions before 1.036 exit the process when reading a TGA image with a colour map length of 32768 or more.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-93018
Heap Memory Disclosure in Imager Perl Module (< 1.036) via Paletted Image Parsing
5.5—
CVE-2026-93019
DoS in Perl Imager: crafted TGA colour map length triggers uncatchable process exit
9.1—