Executive brief
Imager is a Perl library used for generating and manipulating images. A vulnerability in how it handles GIF files allows an attacker to cause a system crash or potentially execute unauthorized code by providing a specially crafted multi-frame GIF image. This could impact applications that automatically process user-uploaded images, leading to service disruptions or data security risks.
Technical details
A heap-based buffer overflow exists in Imager::File::GIF's i_readgif_multi_low function. The function allocates a single per-row buffer (GifRow) based on the GIF's global screen width (SWidth) and reuses it for all frames. While the primary image processing path validates that frame dimensions fit within SWidth, the 'skip-image' branch in imgif.c fails to perform this check before calling DGifGetLine. An attacker can exploit this by providing a GIF with a frame wider than the global screen width, leading to an out-of-bounds write. This is fixed in version 1.031 by moving the dimension validation to a common code path.
Affected products
- Tony Cook (TONYC) Imager through 1.030
Timeline
- 2026-05-12: other: Issue identified
- 2026-05-13: other: Issue reported to maintainer
- 2026-05-15: patched: Fixed version 1.031 released
- 2026-05-15: advisory: Public disclosure