Denial of Service Vulnerability in Imager by TonyCoz for Perl

CVE-2026-93019

What is CVE-2026-93019?

Imager versions prior to 1.036 experience a denial of service vulnerability when processing TGA files with a color map length of 32768 or more. Due to the way the library unpacks the color map length as a signed short, lengths exceeding the threshold are treated as negative values. Consequently, when the tga_palette_read() function tries to allocate memory using an incorrect size, it results in the process exiting unexpectedly. This vulnerability can be exploited by an attacker who provides a specially crafted file, leading to an uncatchable exit from the Imager process during file reading operations.

References