# CVE-2026-13705: TONYC Imager heap out-of-bounds read in SGI reader

Source: https://junglewise.ai/threats/cve-2026-13705-tonyc-imager-heap-out-of-bounds-read-in-sgi-reader  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-13705 · Severity: info · CVSS 3.3 · Published 2026-07-06

Imager is a Perl library used for generating and manipulating images. A vulnerability in its SGI image reader allows a specially crafted image file to cause the application to read memory outside of its intended boundaries. This can lead to an immediate crash of the application, potentially causing a denial of service for systems processing user-uploaded images.

## Quick answers

**Is CVE-2026-13705 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13705 being exploited in the wild.

**How severe is CVE-2026-13705?** Informational severity, with a CVSS score of 3.3, published 6 July 2026.

**Which products and versions are affected?** TONYC Imager before 1.032.

**Is there a fix for CVE-2026-13705?** A patch was published on 2026-06-30: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13705 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-13705?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap out-of-bounds read exists in the Imager::File::SGI reader within the 'read_rgb_16_rle' function in 'SGI/imsgi.c'. The vulnerability is caused by an incorrect bounds check: the code compares a pixel 'count' against 'data_left' (bytes remaining), but fails to account for the fact that 16-bit samples consume two bytes per pixel. Consequently, a run where 'data_left / 2 < count <= data_left' passes the guard but results in an over-read of '2 * count' bytes. An attacker can exploit this by providing a malformed SGI image, leading to a process crash (denial of service). The 8-bit path is unaffected. This issue is fixed in version 1.032.

## Affected products

- TONYC Imager before 1.032

## Timeline

- 2026-06-30: patched: Fix committed to repository
- 2026-07-01: advisory: Release of version 1.032 with security fixes
- 2026-07-06: disclosed: CVE published to NVD

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/tonycoz/imager/commit/f28de02770dfc26ffbdc32048970ed84babbf730.patch](https://github.com/tonycoz/imager/commit/f28de02770dfc26ffbdc32048970ed84babbf730.patch)
- [https://metacpan.org/release/TONYC/Imager-1.032/source/Changes](https://metacpan.org/release/TONYC/Imager-1.032/source/Changes)