CVE-2026-112202: Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images
Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images.
With gifconsolidate => 1, palette indices from the image are used without checking the colour table's bounds. The ireadgiflow routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected.
The same code ships bundled in the Imager distribution.
An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Imager::File::GIFto a version that resolves this vulnerability.Fixed in 1.006 - Upgrade
Upgrade
Imagerto a version that resolves this vulnerability.Fixed in 1.040
Event History
Frequently Asked Questions
Which deployments are affected in practice?
Only code that reads GIFs with the gif_consolidate option set to 1 is affected. The default GIF reader is not affected; the vulnerable code is present both in Imager::File::GIF releases before 1.006 and in bundled Imager distributions containing that code.
What does an attacker need to exploit this issue?
An attacker needs to supply a crafted GIF that is processed by the vulnerable GIF reader with gif_consolidate enabled. Malicious palette indices can cause reads beyond the colour-table heap allocation during image consolidation.
What is the impact of successful exploitation?
Bytes adjacent to the heap allocation can be copied into decoded output pixels, potentially disclosing heap memory to whoever can access that output. The crafted GIF may also crash the processing application.
What can be done if an update cannot be applied immediately?
Avoid processing untrusted GIFs with gif_consolidate set to 1. Using the default GIF reader avoids the affected consolidation path.