Heap Memory Disclosure Vulnerability in Imager by Perl

CVE-2026-93018

What is CVE-2026-93018?

The Imager library for Perl prior to version 1.036 contains a vulnerability that can lead to the disclosure of uninitialized heap memory when processing paletted images. Specifically, when a pixel index exceeds the limits of its color map, the library allows reads from uninitialized memory, potentially exposing sensitive data. This occurs because the TGA reader does not validate pixel indices against the color map's size, leading to unsafe read operations. Consequently, fetching pixels or converting images to RGB with maliciously crafted paletted images can inadvertently reveal previously stored heap data.

References