CPANSA-Imager-2026-19082: Imager vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2026-08-07T00:00:00 | Engine | CSAF Perl Toolkit 0.26 |
| Current release date | 2026-08-07T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | 7.5 | Severity | High |
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags.
copy_string_tags() computes an ASCII EXIF tag's length as `entry->size - 1` to strip the trailing NUL. A zero-count ASCII entry sets `entry->size` to 0, and the derived length reaches i_tags_add() as -1, which is interpreted as a request to call strlen(), scanning past the entry to the next NUL and copying those bytes into the tag. JPEG reaches this path via im_decode_exif(), as does the separate Imager::File::WEBP distribution, which is fixed by upgrading Imager.
Any caller of Imager->read() on an attacker-supplied image with such an entry may receive an exif_* tag holding adjacent heap bytes instead of an empty string.
Vulnerabilities
CVE-2026-19082
Vulnerability DescriptionImager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags.
copy_string_tags() computes an ASCII EXIF tag's length as `entry->size - 1` to strip the trailing NUL. A zero-count ASCII entry sets `entry->size` to 0, and the derived length reaches i_tags_add() as -1, which is interpreted as a request to call strlen(), scanning past the entry to the next NUL and copying those bytes into the tag. JPEG reaches this path via im_decode_exif(), as does the separate Imager::File::WEBP distribution, which is fixed by upgrading Imager.
Any caller of Imager->read() on an attacker-supplied image with such an entry may receive an exif_* tag holding adjacent heap bytes instead of an empty string.
| Weakness | CWE-125 : Out-of-bounds Read |
|---|
Product status
Known affected
| Product | Score | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Imager greater than 0.45_02 |
|
Fixed
- Imager less than 1.034
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-Imager-2026-19082 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-imager-2026-19082.json - https://github.com/tonycoz/imager/commit/24bde0427a113264d53f45a9c29ae756d84c82fe.patch external
https://github.com/tonycoz/imager/commit/24bde0427a113264d53f45a9c29ae756d84c82fe.patch - https://github.com/tonycoz/imager/security/advisories/GHSA-hx46-55wp-hv6m external
https://github.com/tonycoz/imager/security/advisories/GHSA-hx46-55wp-hv6m - https://metacpan.org/release/TONYC/Imager-1.034/changes external
https://metacpan.org/release/TONYC/Imager-1.034/changes - http://www.openwall.com/lists/oss-security/2026/08/07/6 external
http://www.openwall.com/lists/oss-security/2026/08/07/6 - https://github.com/tonycoz/imager/security/advisories/GHSA-hx46-55wp-hv6m external
https://github.com/tonycoz/imager/security/advisories/GHSA-hx46-55wp-hv6m - CVE-2026-19082 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2026-19082
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Fri Aug 7 00:00:00 2026 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/