Out-of-Bounds Read Vulnerability in Imager::File::GIF for Perl

CVE-2026-112202

What is CVE-2026-112202?

The Imager::File::GIF module for Perl contains a vulnerability that allows out-of-bounds reads when processing GIF images. Specifically, when the parameter gif_consolidate is set to 1, palette indices can be accessed without proper bounds checking against the color table. This flaw occurs in the i_readgif_low routine, enabling an attacker to read beyond allocated heap memory by supplying a specially crafted GIF image. Consequently, this may lead to the disclosure of adjacent heap memory through the decoded output. While the default GIF reader remains unaffected, users of the affected versions should apply the latest patches to mitigate potential risks, including process crashes.

References