Imager for Perl before 1.036: heap memory disclosure (CVE-2026-93018) and TGA parsing process exit (CVE-2026-93019)

Two flaws in the Imager image library for Perl, versions before 1.036, disclose uninitialized heap memory via paletted images (CVE-2026-93018) and crash the process via crafted TGA colour maps of length 32768 or more (CVE-2026-93019); both are fixed in Imager…

Stig Palmquist disclosed two vulnerabilities in the Imager image library for Perl, published on oss-security on 2026-09-18. CVE-2026-93018 is an information disclosure flaw: versions before 1.036 return uninitialized heap memory through the i_gpix_p and i_glin_p functions when reading a paletted image containing pixel indexes beyond its colour map, potentially leaking sensitive process memory via decoded image data. CVE-2026-93019 is a denial-of-service flaw: versions before 1.036 terminate the process inside tga_palette_read when parsing a TGA file with a colour map length of 32768 or greater, allowing a crafted image to crash any application that processes untrusted files. Both issues are fixed in Imager 1.036, and no exploitation has been reported for either vulnerability.

• CVE-2026-93018: information disclosure in Imager for Perl versions before 1.036
• CVE-2026-93018 exposes uninitialized heap memory via i_gpix_p and i_glin_p when a paletted image contains pixel indexes past its colour map
• CVE-2026-93019: denial of service in Imager for Perl versions before 1.036
• CVE-2026-93019 causes process exit in tga_palette_read when parsing a TGA file with a colour map length of 32768 or more
• Both vulnerabilities were disclosed by Stig Palmquist on oss-security on 2026-09-18
• Both issues are fixed in Imager 1.036
• No exploitation has been reported for either vulnerability