CVE-2026-93019 Details
Description
Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read. The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tga_palette_read() casts that value to size_t and asks mymalloc() for a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3). Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.
A buffer overflow vulnerability has been identified in Imager versions prior to 1.036 for Perl. The issue arises in the TGA image reader, specifically within the 'tga_palette_read' function. When the color map length is 32768 or greater, it is incorrectly interpreted as a negative value. This negative length is then used to request a memory allocation near the maximum size allowed, causing the allocation to fail. Imager's memory management system responds to this failure by terminating the process, leading to a crash. The vulnerability can be exploited by reading a specially crafted TGA file using the Imager library, which triggers the uncatchable exit.
Users are advised to upgrade to Imager version 1.036 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tonycoz/imager/security/advisories/GHSA-p4vw-rc54-p2c2 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/tonycoz/imager/commit/74ed50e0625f9f51054e595bb4a8da92c1e0d571.patch | CPANSec | Source CodeVendor |
| https://github.com/tonycoz/imager/security/advisories/GHSA-p4vw-rc54-p2c2 | CPANSec | AdvisoryExploitRemedyVendor |
| https://metacpan.org/release/TONYC/Imager-1.036/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/09/18/9 | CVE | AdvisoryMailing ListRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-196 | Unsigned to Signed Conversion Error | CPANSec |
| CWE-789 | Memory Allocation with Excessive Size Value | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Imager | < 1.036 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | CVE Modified | CVE |
| Sep 18, 2026 | New CVE Received | CPANSec |