Executive brief
Imager::File::GIF is a Perl library used for processing and reading GIF image files. A vulnerability in how it handles multi-frame GIF files allows a specially crafted image to cause a memory error. This could lead to application crashes or unpredictable behavior when the software attempts to process a malicious image.
Technical details
A heap out-of-bounds write exists in the i_readgif_multi_low function within imgif.c. The library allocates a single per-row buffer (GifRow) based on the GIF's global screen width (SWidth) and reuses it for all frames. While the 'page-match' branch validates that a frame's width and offset do not exceed SWidth, the 'skip-image' branch (lines 790-805) calls DGifGetLine without this validation. An attacker can provide a multi-frame GIF where a skipped frame's width exceeds the allocated buffer, leading to a heap overflow. This is fixed in version 1.003 by moving the dimension validation to a common code path.
Affected products
- Tony Cook Imager::File::GIF through 1.002
Timeline
- 2026-05-12: other: Issue identified
- 2026-05-13: other: Issue reported to maintainer
- 2026-05-15: patched: Fixed version 1.003 released
- 2026-05-15: advisory: Public disclosure and CVE assignment