CPANSA-Imager-File-GIF-2026-8454: Imager-File-GIF vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2026-05-15T00:00:00 | Engine | CSAF Perl Toolkit 0.26 |
| Current release date | 2026-05-15T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | 5.3 | Severity | |
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
Imager::File::GIF versions through 1.002 for Perl allow a heap out of bounds (OOB) write on crafted multi-frame GIF files. Imager::File::GIF's i_readgif_multi_low allocates a single per-row buffer GifRow sized for the GIF's global screen width 'SWidth' and reuses it across every image in the file. The page-match branch validates Image.Width + Image.Left > SWidth before each DGifGetLine write, but the parallel skip-image branch at imgif.c:790-805 calls DGifGetLine(GifFile, GifRow, Width) with no such check.
Vulnerabilities
CVE-2026-8454
Vulnerability DescriptionImager::File::GIF versions through 1.002 for Perl allow a heap out of bounds (OOB) write on crafted multi-frame GIF files.
Imager::File::GIF's i_readgif_multi_low allocates a single per-row buffer GifRow sized for the GIF's global screen width 'SWidth' and reuses it across every image in the file.
The page-match branch validates Image.Width + Image.Left > SWidth before each DGifGetLine write, but the parallel skip-image branch at imgif.c:790-805 calls DGifGetLine(GifFile, GifRow, Width) with no such check.
| Weakness | CWE-787 : Out-of-bounds Write |
|---|
Product status
Known affected
| Product | Score | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Imager-File-GIF less than 1.003 |
|
Fixed
- Imager-File-GIF greater than or equal 1.003
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-Imager-File-GIF-2026-8454 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-imager-file-gif-2026-8454.json - https://github.com/tonycoz/imager/commit/782e9c06cc75a0f7eed383f39522f51f44598b04.patch external
https://github.com/tonycoz/imager/commit/782e9c06cc75a0f7eed383f39522f51f44598b04.patch - https://metacpan.org/release/TONYC/Imager-File-GIF-1.003/source/Changes external
https://metacpan.org/release/TONYC/Imager-File-GIF-1.003/source/Changes - http://www.openwall.com/lists/oss-security/2026/05/15/15 external
http://www.openwall.com/lists/oss-security/2026/05/15/15 - CVE-2026-8454 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2026-8454
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Fri May 15 00:00:00 2026 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/