Exploitable Buffer Read Issue in Imager for Perl Affecting Multiple Versions

CVE-2026-73638

What is CVE-2026-73638?

A vulnerability exists in Imager for Perl that allows for the potential reading of data outside the designated EXIF block due to unchecked start offsets in the tiff_load_ifd() function. This oversight can lead to an attacker supplying a malicious image that, when processed, causes the application to read EXIF tags containing bytes that are not supposed to be accessible. Specifically, the checks in place fail to account for variations in offset values, enabling the extraction of unintended data. This issue can compromise application stability and potentially disclose sensitive information.

References