# CVE-2026-8669: Imager Perl library heap out-of-bounds write in GIF parser

Source: https://junglewise.ai/threats/cve-2026-8669-imager-perl-library-heap-out-of-bounds-write-in-gif-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-8669 · Severity: medium · CVSS 6.5 · Published 2026-05-15

Imager is a Perl library used for generating and manipulating images. A vulnerability in how it handles GIF files allows an attacker to cause a system crash or potentially execute unauthorized code by providing a specially crafted multi-frame GIF image. This could impact applications that automatically process user-uploaded images, leading to service disruptions or data security risks.

Technologies: [Tony Cook Imager](https://junglewise.ai/threats/technologies/imager), [Tony Cook Imager::File::GIF](https://junglewise.ai/threats/technologies/imager-file-gif). Vendors: [Tony Cook](https://junglewise.ai/threats/vendors/tony-cook).

## Quick answers

**Is CVE-2026-8669 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8669 being exploited in the wild.

**How severe is CVE-2026-8669?** Medium severity, with a CVSS score of 6.5, published 15 May 2026.

**Which products and versions are affected?** Tony Cook Imager through 1.030; Tony Cook Imager::File::GIF through 1.002.

**Is there a fix for CVE-2026-8669?** A patch was published on 2026-05-15: Fixed version 1.031 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8669 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-8669?** Check whether you run Tony Cook Imager or Tony Cook Imager::File::GIF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in Imager::File::GIF's i_readgif_multi_low function. The function allocates a single per-row buffer (GifRow) based on the GIF's global screen width (SWidth) and reuses it for all frames. While the primary image processing path validates that frame dimensions fit within SWidth, the 'skip-image' branch in imgif.c fails to perform this check before calling DGifGetLine. An attacker can exploit this by providing a GIF with a frame wider than the global screen width, leading to an out-of-bounds write. This is fixed in version 1.031 by moving the dimension validation to a common code path.

## Affected products

- Tony Cook (TONYC) Imager through 1.030

## Timeline

- 2026-05-12: other: Issue identified
- 2026-05-13: other: Issue reported to maintainer
- 2026-05-15: patched: Fixed version 1.031 released
- 2026-05-15: advisory: Public disclosure

## References

- [https://github.com/tonycoz/imager/commit/782e9c06cc75a0f7eed383f39522f51f44598b04.patch](https://github.com/tonycoz/imager/commit/782e9c06cc75a0f7eed383f39522f51f44598b04.patch)
- [https://metacpan.org/release/TONYC/Imager-1.031/source/Changes](https://metacpan.org/release/TONYC/Imager-1.031/source/Changes)
- [http://www.openwall.com/lists/oss-security/2026/05/15/17](http://www.openwall.com/lists/oss-security/2026/05/15/17)

## Related threats

- [Imager::File::GIF out-of-bounds read in GIF consolidation](https://junglewise.ai/threats/cve-2026-112202-imager-file-gif-versions-before-1-006-for-perl-allow-out-of)
- [Imager heap buffer overflow in i_gsampf_fp fetching float samples](https://junglewise.ai/threats/cve-2026-102505-imager-versions-before-1-037-for-perl-overflow-a-heap-buffer)
- [TONYC Imager unsigned to signed conversion error in EXIF parsing](https://junglewise.ai/threats/cve-2026-14454-tonyc-imager-unsigned-to-signed-conversion-error-in-exif-parsing)
- [Imager::File::GIF heap out-of-bounds write in i_readgif_multi_low](https://junglewise.ai/threats/cve-2026-8454-imager-file-gif-heap-out-of-bounds-write-in-i-readgif-multi-low)