Buffer Overflow in Imager::File::PNG Affecting Perl Implementation

CVE-2026-73639

What is CVE-2026-73639?

A vulnerability exists in Imager::File::PNG versions prior to 1.004 for Perl, where an attacker can supply a specially crafted PNG file. The vulnerability arises when the function read_direct8() processes a PNG with a tRNS transparency chunk, adding an alpha channel while not adequately sizing the row buffer. This can result in the png_read_row() function writing bytes beyond the allocated buffer, leading to heap corruption and potentially crashing the application. The same vulnerability can affect processes using the bundled reader within the Imager distribution, highlighting the need for immediate attention and patches.

References