CVE-2026-93019

Published: Set 18, 2026 Last Modified: Set 18, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read.

The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tga_palette_read() casts that value to size_t and asks mymalloc() for a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3).

Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.

196

Unsigned to Signed Conversion Error

Draft
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Integrity Confidentiality Access Control
Potential Impacts:
Dos: Crash, Exit, Or Restart Modify Memory Execute Unauthorized Code Or Commands Bypass Protection Mechanism
Applicable Platforms
Languages: C, C++
Likelihood of Exploit: Medium
View CWE Details
789

Memory Allocation with Excessive Size Value

Draft
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Resource Consumption (Memory)
Applicable Platforms
Languages: C, C++, Not Language-Specific
View CWE Details
https://github.com/tonycoz/imager/commit/74ed50e0625f9f5105…
https://github.com/tonycoz/imager/commit/74ed50e0625f9f51054e595bb4a8da92c1e0d5…
https://github.com/tonycoz/imager/security/advisories/GHSA-…
https://github.com/tonycoz/imager/security/advisories/GHSA-p4vw-rc54-p2c2
https://metacpan.org/release/TONYC/Imager-1.036/changes
https://metacpan.org/release/TONYC/Imager-1.036/changes