CVE-2026-93019: Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read
Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tgapaletteread.
The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tgapaletteread() casts that value to sizet and asks mymalloc() for a size near SIZEMAX. The allocation fails and Imager's allocator calls exit(3).
Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Imager (Perl)to a version that resolves this vulnerability.Fixed in 1.036
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Imager before 1.036 are exposed if they read attacker-supplied TGA files through Imager->read(). A crafted TGA colour map length of 32768 or greater can terminate the process.
What does an attacker need to exploit it?
An attacker needs to cause the application to read a malicious TGA file. No additional conditions are described beyond supplying a TGA whose colour map length is at least 32768.
Can the application catch the failure and continue processing?
No. The allocation failure causes Imager's allocator to call exit(3), and the resulting process exit is described as uncatchable when triggered through Imager->read().
What can be done if upgrading is not immediately possible?
Do not process untrusted TGA files with affected Imager versions. If TGA input must be accepted, reject files with colour map lengths of 32768 or greater before passing them to Imager->read().