Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tgapaletteread.

The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tgapaletteread() casts that value to sizet and asks mymalloc() for a size near SIZEMAX. The allocation fails and Imager's allocator calls exit(3).

Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copystringtags.

copystringtags() computes an ASCII EXIF tag's length as entry->size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry->size to 0, and the derived length reaches itagsadd() as -1, which is interpreted as a request to call strlen(), scanning past the entry to the next NUL and copying those bytes into the tag. JPEG reaches this path via imdecodeexif(), as does the separate Imager::File::WEBP distribution, which is fixed by upgrading Imager.

Any caller of Imager->read() on an attacker-supplied image with such an entry may receive an exif tag holding adjacent heap bytes instead of an empty string.

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range rawdatachannels value in ireadrawwiol.

Nothing range-checks rawdatachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large count requests an excessive allocation. When it fails, Imager's allocator calls exit(3).

Passing an untrusted rawdatachannels value to Imager->read() triggers an uncatchable exit.