> CVE-2026-93019

« BACK_TO_HOME
PUBLISHED
2026-09-18 14:19
MODIFIED
2026-09-18 14:19
EPSS (Prob. Exploit)
0.65%
Top 49.7%
DATA SOURCES:
NVD 🔗 2026-09-18 CWE MITRE 🔗 2026-10-01 FIRST EPSS 🔗 2026-10-17 OSV 🔗 2026-10-19

> DESCRIPTION

Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read. The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tga_palette_read() casts that value to size_t and asks mymalloc() for a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3). Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-196 CWE-789

> CWE DETAILED DESCRIPTIONS

CWE-196: Unsigned to Signed Conversion Error - The product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned primitive can not be represented using a signed primitive. | CWE-789: Memory Allocation with Excessive Size Value - The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read

AFFECTED PACKAGES:
Unknown / Unknown
92 versions affected
ALIASES:
GHSA-p4vw-rc54-p2c2

> HISTORIQUE DES MODIFICATIONS

Première apparition
18/09/2026 14:19
Source: NVD
📊 ENRICHISSEMENT 01/10/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-196: Unsigned to Signed Conversion Error - The product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned prim...
Total des modifications: 1 Dernière mise à jour: 3 weeks ago

> REFERENCES

https://github.com/tonycoz/imager/commit/74ed50e0625f9f51054e595bb4a8da92c1e0d57...
https://github.com/tonycoz/imager/security/advisories/GHSA-p4vw-rc54-p2c2
https://metacpan.org/release/TONYC/Imager-1.036/changes
« BACK_TO_HOME