# CVE-2026-73639: Imager::File::PNG heap buffer overflow in PNG transparency handling

Source: https://junglewise.ai/threats/cve-2026-73639-imager-file-png-heap-buffer-overflow-in-png-transparency-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-73639 · Severity: critical · CVSS 9.1 · Published 2026-09-17

Imager is a Perl library for reading and manipulating image files. A flaw in PNG transparency processing causes the library to write past the end of allocated memory when processing PNG files with transparency chunks. This can crash applications using the library and may allow arbitrary code execution through heap corruption.

Vendors: [Tony Cook](https://junglewise.ai/threats/vendors/tony-cook).

## Quick answers

**Is CVE-2026-73639 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73639 being exploited in the wild.

**How severe is CVE-2026-73639?** Critical severity, with a CVSS score of 9.1, published 17 September 2026.

**Which products and versions are affected?** Tony Cook Imager::File::PNG 1.003 before 1.004.

**Is there a fix for CVE-2026-73639?** A patch was published on 2026-08-08: patch committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73639 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73639?** Check whether you run Tony Cook Imager::File::PNG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a heap buffer overflow in the read_direct8() function when processing PNG files with tRNS (transparency) chunks. The root cause is a mismatch between buffer allocation and actual row size: read_direct8() allocates a buffer based on the original channel count but libpng's png_read_row() expands transparency data into an additional alpha channel, writing one extra byte per pixel past the buffer boundary. The flaw affects direct RGB/grayscale 8-bit images; palette and 16-bit paths correctly use png_get_rowbytes() for proper sizing. An attacker can craft a malicious PNG file that, when read via Imager->read(), corrupts the heap and crashes the process. The patch (released in version 1.004) fixes the issue by using the correct (volatile-qualified) channel count variable for buffer allocation instead of the original parameter.

## Affected products

- Tony Cook Imager::File::PNG 1.003 before 1.004

## Timeline

- 2026-09-17: disclosed
- 2026-08-08: patched: patch committed to repository

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/tonycoz/imager/commit/d973bd7e8843f084e8071caa24b89545c88b1e4b.patch](https://github.com/tonycoz/imager/commit/d973bd7e8843f084e8071caa24b89545c88b1e4b.patch)