CVE-2026-19082 in Imager
Summary
by MITRE • 08/07/2026
Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags.
copy_string_tags() computes an ASCII EXIF tag's length as `entry->size - 1` to strip the trailing NUL. A zero-count ASCII entry sets `entry->size` to 0, and the derived length reaches i_tags_add() as -1, which is interpreted as a request to call strlen(), scanning past the entry to the next NUL and copying those bytes into the tag. JPEG reaches this path via im_decode_exif(), as does the separate Imager::File::WEBP distribution, which is fixed by upgrading Imager.
Any caller of Imager->read() on an attacker-supplied image with such an entry may receive an exif_* tag holding adjacent heap bytes instead of an empty string.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability resides in the Imager Perl library version 0.45_02 through 1.033, where a heap-based information disclosure occurs due to improper handling of zero-count ASCII EXIF entries during image processing operations. The flaw manifests when the copy_string_tags() function processes EXIF metadata, specifically targeting ASCII formatted entries that contain zero-length data. The core technical issue stems from a mathematical error in length calculation where entry->size is set to 0 for zero-count entries, resulting in a computed length of -1 when subtracting 1. This negative value triggers an unintended code path within the i_tags_add() function that invokes strlen() instead of performing normal string copying operations. The strlen() call then scans forward through heap memory until it encounters the next null byte, inadvertently copying adjacent heap data into the target EXIF tag structure.
The operational impact of this vulnerability extends to any application utilizing Imager's read() method when processing images provided by untrusted sources. When an attacker crafts a JPEG file containing specifically formatted zero-count ASCII EXIF entries, the library's parsing routine will populate exif_* tags with heap contents rather than empty strings as expected. This information disclosure represents a significant security risk since the copied data may contain sensitive information from other memory regions, including application state, cryptographic keys, or user data that was previously stored in adjacent heap locations. The vulnerability affects not only the core Imager library but also the Imager::File::WEBP distribution which shares the same problematic code path, making it a widespread issue across multiple image format handling modules within the Perl ecosystem.
The root cause of this vulnerability aligns with CWE-126: Buffer Over-read and CWE-200: Information Disclosure, where improper bounds checking leads to unintended memory access patterns. From an adversarial perspective, this flaw maps directly to ATT&CK technique T1552.001: Unsecured Credentials, as the heap data exposure could potentially reveal sensitive information that might aid further exploitation attempts. The vulnerability's exploitation requires an attacker to craft a malicious image file with specifically formatted zero-count ASCII EXIF entries, which can be achieved through standard image manipulation tools or by leveraging existing EXIF editing capabilities. Given the widespread use of Imager for image processing in Perl applications, including web applications and server-side image handling systems, this vulnerability presents a substantial risk to organizations that process untrusted image uploads without proper input validation. The fix requires upgrading to Imager version 1.034 or later where the copy_string_tags() function properly handles zero-length entries by implementing correct bounds checking and preventing the negative length calculation that triggers the unintended strlen() behavior.
This vulnerability demonstrates a classic example of how seemingly minor arithmetic errors in memory management can lead to significant information disclosure issues. The improper handling of entry size calculations creates a scenario where legitimate security mechanisms fail to prevent unauthorized data access, making it particularly dangerous in environments where untrusted image content is processed. The remediation process requires careful attention to ensure that all applications using Imager or related WEBP modules are updated to versions that properly validate and handle zero-length EXIF entries. Organizations should also implement additional monitoring for unexpected heap data exposure patterns in their image processing pipelines and consider implementing input sanitization measures that can detect and reject malformed EXIF structures even before they reach the vulnerable library functions.