# CVE-2026-8454: Imager::File::GIF heap out-of-bounds write in i_readgif_multi_low

Source: https://junglewise.ai/threats/cve-2026-8454-imager-file-gif-heap-out-of-bounds-write-in-i-readgif-multi-low  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-8454 · Severity: medium · CVSS 5.3 · Published 2026-05-15

Imager::File::GIF is a Perl library used for processing and reading GIF image files. A vulnerability in how it handles multi-frame GIF files allows a specially crafted image to cause a memory error. This could lead to application crashes or unpredictable behavior when the software attempts to process a malicious image.

Technologies: [Tony Cook Imager::File::GIF](https://junglewise.ai/threats/technologies/imager-file-gif). Vendors: [Tony Cook](https://junglewise.ai/threats/vendors/tony-cook).

## Quick answers

**Is CVE-2026-8454 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8454 being exploited in the wild.

**How severe is CVE-2026-8454?** Medium severity, with a CVSS score of 5.3, published 15 May 2026.

**Which products and versions are affected?** Tony Cook Imager::File::GIF through 1.002.

**Is there a fix for CVE-2026-8454?** A patch was published on 2026-05-15: Fixed version 1.003 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8454 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8454?** Check whether you run Tony Cook Imager::File::GIF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap out-of-bounds write exists in the i_readgif_multi_low function within imgif.c. The library allocates a single per-row buffer (GifRow) based on the GIF's global screen width (SWidth) and reuses it for all frames. While the 'page-match' branch validates that a frame's width and offset do not exceed SWidth, the 'skip-image' branch (lines 790-805) calls DGifGetLine without this validation. An attacker can provide a multi-frame GIF where a skipped frame's width exceeds the allocated buffer, leading to a heap overflow. This is fixed in version 1.003 by moving the dimension validation to a common code path.

## Affected products

- Tony Cook Imager::File::GIF through 1.002

## Timeline

- 2026-05-12: other: Issue identified
- 2026-05-13: other: Issue reported to maintainer
- 2026-05-15: patched: Fixed version 1.003 released
- 2026-05-15: advisory: Public disclosure and CVE assignment

## References

- [https://github.com/tonycoz/imager/commit/782e9c06cc75a0f7eed383f39522f51f44598b04.patch](https://github.com/tonycoz/imager/commit/782e9c06cc75a0f7eed383f39522f51f44598b04.patch)
- [https://metacpan.org/release/TONYC/Imager-File-GIF-1.003/source/Changes](https://metacpan.org/release/TONYC/Imager-File-GIF-1.003/source/Changes)
- [http://www.openwall.com/lists/oss-security/2026/05/15/15](http://www.openwall.com/lists/oss-security/2026/05/15/15)

## Related threats

- [Imager::File::GIF out-of-bounds read in GIF consolidation](https://junglewise.ai/threats/cve-2026-112202-imager-file-gif-versions-before-1-006-for-perl-allow-out-of)
- [Imager Perl library heap out-of-bounds write in GIF parser](https://junglewise.ai/threats/cve-2026-8669-imager-perl-library-heap-out-of-bounds-write-in-gif-parser)