CVE-2026-73639 in Imager
Summary
by MITRE • 09/18/2026
Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8.
With a tRNS chunk, read_direct8() adds an alpha channel to the image it creates but still sizes the row buffer from the original channel count. libpng expands the transparency into that extra channel, so png_read_row() fills one channel more than the buffer holds, at one byte per sample, and writes width bytes past the end of the allocation. Palette images go to read_paletted() and 16-bit images to read_direct16(), which sizes its buffer from png_get_rowbytes() and allocates enough for the expanded row.
The same reader ships bundled in the Imager distribution.
Reading an attacker-supplied PNG through Imager->read() corrupts the heap, which can crash the process.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in Imager::File::PNG versions prior to 1.004 represents a critical memory safety flaw rooted in improper buffer management during image processing operations. Specifically, this issue manifests as an out-of-bounds write when parsing PNG files that contain a tRNS transparency chunk. The core technical failure occurs within the read_direct8 function, which is responsible for handling direct eight-bit color images. When such an image includes transparency data encoded in a tRNS chunk, the library attempts to augment the existing pixel data with an alpha channel to represent opacity levels. However, the implementation fails to adjust the size of the internal row buffer to accommodate this additional channel. Instead, it continues to allocate memory based on the original number of color channels present before transparency expansion.
This discrepancy leads directly to a heap-based buffer overflow condition. As libpng processes the image data and expands the transparency information into the newly conceptualized alpha channel, the png_read_row function writes one byte per sample for each pixel in the row. Because the allocated buffer was sized only for the original channel count without accounting for the added alpha component, the write operation exceeds the boundaries of the allocated memory region. Consequently, the application writes width bytes past the end of the heap allocation associated with that specific image row. This behavior is distinct from other processing paths within the library; palette-based images are routed to read_paletted and sixteen-bit images to read_direct16, both of which correctly utilize png_get_rowbytes to determine buffer sizes, thereby avoiding this specific overflow scenario.
The operational impact of this vulnerability is severe, primarily affecting applications that accept user-supplied PNG files through the Imager->read interface. The immediate consequence of triggering this flaw is heap corruption, which typically results in application crashes or denial of service conditions due to memory access violations. Beyond stability issues, such buffer overflows pose significant security risks as they can potentially be exploited for arbitrary code execution if an attacker can carefully craft a malicious PNG file that leverages the overwritten memory to redirect control flow. This aligns with common exploitation techniques where heap metadata corruption or adjacent object manipulation is used to achieve remote code execution capabilities within the context of the vulnerable process.
From a classification perspective, this vulnerability corresponds closely to CWE-120, which denotes buffer copy without checking size limits, and more specifically CWE-787, indicating an out-of-bounds write. In terms of attack vectors, it falls under ATT&CK technique T1190, Exploit Public-Facing Application, as the flaw is triggered by processing external input files that are often served or uploaded via web-facing services utilizing image manipulation libraries. The vulnerability also reflects CWE-416, Use After Free, in a broader sense of memory state inconsistency, although it is primarily an out-of-bounds write rather than a use-after-free scenario.
Mitigation strategies for this issue involve immediate upgrading to Imager::File::PNG version 1.004 or later, where the buffer allocation logic has been corrected to account for the expanded channel count when transparency data is present. For environments unable to upgrade immediately, input validation should be implemented at the application layer to restrict accepted file types and sizes. Additionally, deploying runtime protection mechanisms such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) can mitigate the likelihood of successful exploitation by making memory layout unpredictable and preventing code execution from data pages. Developers integrating this library into larger systems should also consider implementing strict bounds checking on image dimensions and channel counts before initiating read operations to add an extra layer of defense against malformed inputs.