Executive brief
Imager is a Perl image processing library used to read and manipulate image files. A flaw in its TIFF file parsing allows attackers to craft malicious TIFF files that cause the library to read data outside allocated memory buffers, potentially exposing sensitive information or crashing applications that process untrusted images.
Technical details
The vulnerability exists in the tiff_load_ifd() function, which parses TIFF Image File Directory (IFD) entries. The validator checks that the sum of an entry's offset and size stays within the EXIF block, but fails to validate the start offset itself. On 32-bit systems and 64-bit Windows (where size_t or unsigned long are 32 bits), integer wrap-around can cause the bounds check to pass when an entry actually starts or extends outside the intended block. The field type changed from int (vulnerable to sign-bit wrapping in versions ≤1.032) to size_t (vulnerable to unsigned wrap on 32-bit systems in versions ≥1.033). Any application calling Imager->read() on attacker-supplied TIFF images can leak EXIF data from outside the block or crash.
Affected products
- Tony Bowden Imager 0.45_02 to before 1.035
Timeline
- 2026-09-17: disclosed
- 2026-09-17: advisory