CVE-2026-73639

Imager-File-PNG · Vulnerability

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-73639

Published

Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8. With a tRNS chunk, read_direct8() adds an alpha channel to the image it creates but still sizes the row buffer from the original channel count. libpng expands the transparency into that extra channel, so png_read_row() fills one channel more than the buffer holds, at one byte per sample, and writes width bytes past the end of the allocation. Palette images go to read_paletted() and 16-bit images to read_direct16(), which sizes its buffer from png_get_rowbytes() and allocates enough for the expanded row. The same reader ships bundled in the Imager distribution. Reading an attacker-supplied PNG through Imager->read() corrupts the heap, which can crash the process.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-73639

Published

Imager-File-PNG

https://cpan.org/modules

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "collectionURL": "https://cpan.org/modules",
                    "defaultStatus": "unaffected",
                    "modules": [
                        "Imager::File::PNG"
                    ],
                    "packageName": "Imager-File-PNG",
                    "packageURL": "pkg:cpan/Imager-File-PNG",
                    "programFiles": [
                        "impng.c"
                    ],
                    "programRoutines": [
                        {
                            "name": "read_direct8"
                        }
                    ],
                    "repo": "https://github.com/tonycoz/imager",
                    "versions": [
                        {
                            "lessThan": "1.004",
                            "status": "affected",
                            "version": "1.003",
                            "versionType": "custom"
                        }
                    ]
                }

Imager

https://cpan.org/modules

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "collectionURL": "https://cpan.org/modules",
                    "defaultStatus": "unaffected",
                    "modules": [
                        "Imager::File::PNG"
                    ],
                    "packageName": "Imager",
                    "packageURL": "pkg:cpan/Imager",
                    "programFiles": [
                        "PNG/impng.c"
                    ],
                    "programRoutines": [
                        {
                            "name": "read_direct8"
                        }
                    ],
                    "repo": "https://github.com/tonycoz/imager",
                    "versions": [
                        {
                            "lessThan": "1.035",
                            "status": "affected",
                            "version": "1.034",
                            "versionType": "custom"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON