CVE-2026-13705: Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle
Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in readrgb16rle.
readrgb16rle guards each literal run with if (count > dataleft), but count is a pixel count while every 16-bit sample consumes two bytes. The copy loop reads inp[0] 256 + inp[1] and advances two bytes per pixel, so a run with dataleft / 2 < count <= dataleft passes the guard yet consumes 2 count bytes and reads past the end of the buffer. The 8-bit path is unaffected because there one pixel is one byte.
Reading a crafted SGI image through Imager->read triggers the over-read before the parser rejects the malformed image, which can crash the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Imager (Perl)to a version that resolves this vulnerability.Fixed in 1.032
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13705?
CVE-2026-13705 has a severity rating of high, with a CVSS score of 7.1.
How do I fix CVE-2026-13705?
To mitigate CVE-2026-13705, upgrade to Imager version 1.032 or later.
What causes the vulnerability in CVE-2026-13705?
CVE-2026-13705 is caused by a heap out-of-bounds read in the bundled Imager::File::SGI reader due to improper handling of 16-bit RLE literal runs.
Is CVE-2026-13705 a critical vulnerability?
While CVE-2026-13705 is classified as high severity, it is not considered critical.
What are the potential impacts of CVE-2026-13705?
CVE-2026-13705 could lead to information disclosure due to the heap out-of-bounds read.