CVE-2026-73639: Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8
Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in readdirect8.
With a tRNS chunk, readdirect8() adds an alpha channel to the image it creates but still sizes the row buffer from the original channel count. libpng expands the transparency into that extra channel, so pngreadrow() fills one channel more than the buffer holds, at one byte per sample, and writes width bytes past the end of the allocation. Palette images go to readpaletted() and 16-bit images to readdirect16(), which sizes its buffer from pnggetrowbytes() and allocates enough for the expanded row.
The same reader ships bundled in the Imager distribution.
Reading an attacker-supplied PNG through Imager->read() corrupts the heap, which can crash the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Imager::File::PNGto a version that resolves this vulnerability.Fixed in 1.004 - Upgrade
Upgrade
Imagerto a version that resolves this vulnerability.Fixed in 1.035 - Compensating control
Until upgraded, avoid reading attacker-supplied PNGs via Imager->read() (e.g., do not process untrusted PNG inputs).
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using Perl Imager to read attacker-supplied PNG files through Imager->read() are exposed when the affected PNG reader is used. The reader is also bundled with the Imager distribution.
What kind of PNG triggers the flaw?
The PNG must contain a tRNS transparency chunk and be handled by read_direct8(). Palette images use read_paletted(), and 16-bit images use read_direct16(), which allocates for the expanded row.
What is the practical impact of processing a crafted file?
libpng can write one byte per pixel beyond the allocated row buffer, corrupting the heap. This can crash the process reading the image.
Which versions should be remediated?
Imager::File::PNG versions from 1.003 before 1.004 are affected. Update to 1.004 or later.