CVE-2026-112202 in Imager
Summary
by MITRE • 10/22/2026
Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images.
With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected.
The same code ships bundled in the Imager distribution.
An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
Imager::File::GIF versions prior to 1.006 for Perl contain an out-of-bounds read vulnerability that occurs during the consolidation of GIF images when specific configuration options are enabled. The flaw is located within the i_readgif_low routine, which handles low-level reading and processing of GIF data structures. When the gif_consolidate option is set to 1, the library attempts to merge multiple image frames or consolidate palette information into a single output buffer. During this process, the code retrieves color indices from the input image's palette but fails to validate these indices against the actual size of the allocated color table. This lack of boundary checking allows the routine to access memory locations that lie beyond the intended heap allocation for the color map.
The technical consequence of this unchecked index usage is a classic out-of-bounds read, which falls under CWE-125 in common vulnerability enumeration standards. As the i_readgif_low function proceeds with consolidation, it copies data from these invalid memory addresses into the output pixel buffer. Because the source of this data is outside the bounds of the allocated color table, the application reads arbitrary bytes from adjacent heap memory regions. This behavior creates a direct information disclosure vector, as an attacker can potentially extract sensitive data stored in neighboring memory blocks that were not intended to be accessed by the image processing logic.
From an operational perspective, while the default GIF reader configuration is unaffected because it does not enable gif_consolidate by default, applications that explicitly configure this option are vulnerable. The impact of exploiting this vulnerability extends beyond mere information disclosure; reading invalid heap memory can also lead to process instability and crashes if the accessed memory pages are unmapped or protected. This aligns with CWE-126 regarding buffer over-read conditions which can cause denial of service through application termination. Furthermore, depending on how the extracted data is handled by the host application, this vulnerability could facilitate more complex attacks such as heap spraying or further exploitation attempts if the leaked information reveals memory layout details useful for bypassing security mitigations like ASLR.
The Imager distribution bundles this vulnerable code path, meaning any Perl-based image processing pipeline that utilizes GIF consolidation features with older versions of the library is at risk. To mitigate this vulnerability, organizations and developers must upgrade to Imager::File::GIF version 1.006 or later where proper bounds checking has been implemented for palette indices during consolidation operations. In environments where upgrading is not immediately feasible, it is critical to ensure that the gif_consolidate option remains disabled unless absolutely necessary, thereby avoiding the execution path containing the flaw. Additionally, implementing strict input validation on uploaded GIF files and deploying runtime application self-protection mechanisms can help detect anomalous memory access patterns indicative of such exploitation attempts. This vulnerability highlights the importance of rigorous boundary checks in image parsing libraries to prevent both data leakage and service disruption through heap-based attacks.