Is CVE-2026-8669 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8669 being exploited in the wild.

How severe is CVE-2026-8669?

Medium severity, with a CVSS score of 6.5, published 15 May 2026.

Which products and versions are affected?

Tony Cook Imager through 1.030; Tony Cook Imager::File::GIF through 1.002.

Is there a fix for CVE-2026-8669?

A patch was published on 2026-05-15: Fixed version 1.031 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8669 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-8669?

Check whether you run Tony Cook Imager or Tony Cook Imager::File::GIF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8669: Imager Perl library heap out-of-bounds write in GIF parser

CVE-2026-8669 · Severity: medium · CVSS 6.5 · Published 2026-05-15

Imager is a Perl library used for generating and manipulating images. A vulnerability in how it handles GIF files allows an attacker to cause a system crash or potentially execute unauthorized code by providing a specially crafted multi-frame GIF image. This could impact applications that automatically process user-uploaded images, leading to service disruptions or data security risks.

Technologies: Tony Cook Imager, Tony Cook Imager::File::GIF. Vendors: Tony Cook.

Quick answers

Is CVE-2026-8669 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8669 being exploited in the wild.
How severe is CVE-2026-8669?: Medium severity, with a CVSS score of 6.5, published 15 May 2026.
Which products and versions are affected?: Tony Cook Imager through 1.030; Tony Cook Imager::File::GIF through 1.002.
Is there a fix for CVE-2026-8669?: A patch was published on 2026-05-15: Fixed version 1.031 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8669 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-8669?: Check whether you run Tony Cook Imager or Tony Cook Imager::File::GIF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in Imager::File::GIF's i_readgif_multi_low function. The function allocates a single per-row buffer (GifRow) based on the GIF's global screen width (SWidth) and reuses it for all frames. While the primary image processing path validates that frame dimensions fit within SWidth, the 'skip-image' branch in imgif.c fails to perform this check before calling DGifGetLine. An attacker can exploit this by providing a GIF with a frame wider than the global screen width, leading to an out-of-bounds write. This is fixed in version 1.031 by moving the dimension validation to a common code path.

Affected products

Tony Cook (TONYC) Imager through 1.030

Timeline

2026-05-12: other: Issue identified
2026-05-13: other: Issue reported to maintainer
2026-05-15: patched: Fixed version 1.031 released
2026-05-15: advisory: Public disclosure

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.