CVE-2026-8669 Details
Description
Imager versions through 1.030 for Perl allow a heap out of bounds (OOB) write on crafted multi-frame GIF files. Imager::File::GIF's i_readgif_multi_low allocates a single per-row buffer GifRow sized for the GIF's global screen width 'SWidth' and reuses it across every image in the file. The page-match branch validates Image.Width + Image.Left > SWidth before each DGifGetLine write, but the parallel skip-image branch at imgif.c:790-805 calls DGifGetLine(GifFile, GifRow, Width) with no such check.
A heap-based buffer overflow vulnerability has been identified in the Imager library, specifically in versions through 1.030, when processing crafted multi-frame GIF files. The issue arises in the Imager::File::GIF module's 'i_readgif_multi_low' function, which allocates a single buffer per row, sized according to the GIF's global screen width. This buffer is reused across all images in the file. While the function includes a validation step for the image dimensions before writing to the buffer, this check is bypassed in the parallel skip-image branch, leading to the out-of-bounds write.
Users can upgrade to Imager version 1.031, which includes a patch for this vulnerability. Instructions for downloading the updated version are available on the MetaCPAN Imager release page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 15, 2026CISA-ADP
Assessed May 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tonycoz/imager/commit/782e9c06cc75a0f7eed383f39522f51f44598b04.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/TONYC/Imager-1.031/source/Changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/05/15/17 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Imager | <= 1.030 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | CVE Modified | CVE |
| May 15, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | New CVE Received | CPANSec |