Executive brief
Imager is a Perl library used for generating and manipulating images. A vulnerability in its SGI image reader allows a specially crafted image file to cause the application to read memory outside of its intended boundaries. This can lead to an immediate crash of the application, potentially causing a denial of service for systems processing user-uploaded images.
Technical details
A heap out-of-bounds read exists in the Imager::File::SGI reader within the 'read_rgb_16_rle' function in 'SGI/imsgi.c'. The vulnerability is caused by an incorrect bounds check: the code compares a pixel 'count' against 'data_left' (bytes remaining), but fails to account for the fact that 16-bit samples consume two bytes per pixel. Consequently, a run where 'data_left / 2 < count <= data_left' passes the guard but results in an over-read of '2 * count' bytes. An attacker can exploit this by providing a malformed SGI image, leading to a process crash (denial of service). The 8-bit path is unaffected. This issue is fixed in version 1.032.
Affected products
- TONYC Imager before 1.032
Timeline
- 2026-06-30: patched: Fix committed to repository
- 2026-07-01: advisory: Release of version 1.032 with security fixes
- 2026-07-06: disclosed: CVE published to NVD