CVE-2026-93018: Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p

Published Sep 18, 2026
·
Updated

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in igpixp and iglinp.

The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without checking them against the colour map. igpixp() rejects only an index greater than the count, so an index equal to it reads the first unpopulated entry, and getpixel() returns it.

iglinp() skips any index at or beyond the count without writing that pixel to the caller's buffer. The palette-to-RGB conversion reads each row through an uninitialised buffer, so those pixels of the converted image hold prior heap contents.

Reading an attacker-supplied image through Imager->read() and then fetching its pixels or converting it to RGB discloses process heap memory.

Affected Software

1 affected component
Imager<1.036

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Imager (Perl) to a version that resolves this vulnerability.

    Fixed in 1.036
  2. Configuration

    Update Imager such that i_gpix_p() rejects indexes at or beyond the palette count (not only indexes greater than the count) to prevent reading uninitialised palette entries.

    Imager (Perl) TGA reader / palette index handling i_gpix_p index validation = reject index >= count (fix for reading unpopulated palette entry)
  3. Configuration

    Ensure i_glin_p() continues to skip any palette index at or beyond the count so it does not write those pixels to the caller's buffer.

    Imager (Perl) palette index handling i_glin_p index skipping = skip indexes >= count

Event History

Sep 18, 2026
CVE Published
via MITRE·01:57 PM
Data Sourced
via MITRE·01:57 PM
RemedyDescriptionWeakness

Frequently Asked Questions

1

Who is exposed to this issue?

Applications using Imager before 1.036 are exposed if they read attacker-supplied paletted TGA images and subsequently fetch pixels or convert the image to RGB. The disclosure occurs within the application's process, so exposure depends on whether the resulting pixel data can be returned, logged, stored, or otherwise observed by an attacker.

2

What does an attacker need to provide?

The attacker needs to supply a paletted image with pixel indexes that are outside its populated colour map. The TGA reader stores those indexes without validating them against the colour map.

3

Are all invalid palette indexes handled the same way?

No. In i_gpix_p(), an index equal to the populated colour-map count can return the first unpopulated palette entry. In i_glin_p(), indexes at or beyond that count leave pixels unwritten in a buffer that is later used during palette-to-RGB conversion, allowing prior heap contents to appear in converted pixels.

4

What version addresses the issue?

Upgrade Imager to version 1.036 or later. Versions before 1.036 are affected according to the available information.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203