Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-93018

Imager · Vulnerability

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-93018

Published

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without checking them against the colour map. i_gpix_p() rejects only an index greater than the count, so an index equal to it reads the first unpopulated entry, and getpixel() returns it. i_glin_p() skips any index at or beyond the count without writing that pixel to the caller's buffer. The palette-to-RGB conversion reads each row through an uninitialised buffer, so those pixels of the converted image hold prior heap contents. Reading an attacker-supplied image through Imager->read() and then fetching its pixels or converting it to RGB discloses process heap memory.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-93018

Published

Imager

https://cpan.org/modules

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "collectionURL": "https://cpan.org/modules",
                    "defaultStatus": "unaffected",
                    "modules": [
                        "Imager"
                    ],
                    "packageName": "Imager",
                    "packageURL": "pkg:cpan/Imager",
                    "programFiles": [
                        "palimg.c"
                    ],
                    "programRoutines": [
                        {
                            "name": "i_gpix_p"
                        },
                        {
                            "name": "i_glin_p"
                        }
                    ],
                    "repo": "https://github.com/tonycoz/imager",
                    "versions": [
                        {
                            "lessThan": "1.036",
                            "status": "affected",
                            "version": "0",
                            "versionType": "custom"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON