Executive brief
Imager is a Perl library for reading and manipulating image files. A flaw in PNG transparency processing causes the library to write past the end of allocated memory when processing PNG files with transparency chunks. This can crash applications using the library and may allow arbitrary code execution through heap corruption.
Technical details
The vulnerability is a heap buffer overflow in the read_direct8() function when processing PNG files with tRNS (transparency) chunks. The root cause is a mismatch between buffer allocation and actual row size: read_direct8() allocates a buffer based on the original channel count but libpng's png_read_row() expands transparency data into an additional alpha channel, writing one extra byte per pixel past the buffer boundary. The flaw affects direct RGB/grayscale 8-bit images; palette and 16-bit paths correctly use png_get_rowbytes() for proper sizing. An attacker can craft a malicious PNG file that, when read via Imager->read(), corrupts the heap and crashes the process. The patch (released in version 1.004) fixes the issue by using the correct (volatile-qualified) channel count variable for buffer allocation instead of the original parameter.
Affected products
- Tony Cook Imager::File::PNG 1.003 before 1.004
Timeline
- 2026-09-17: disclosed
- 2026-08-08: patched: patch committed to repository