CVE-2026-93019 in Imager
Summary
by MITRE • 09/18/2026
Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read.
The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tga_palette_read() casts that value to size_t and asks mymalloc() for a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3).
Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability in Perl’s Imager module, specifically affecting versions prior to 1.036, represents a critical denial of service condition triggered by the mishandling of color map lengths within Tagged Image File Format (TGA) files. The core technical flaw resides in the tga_palette_read function, which is responsible for parsing palette data from TGA images. When processing these files, the module reads a two-byte integer representing the length of the color map and interprets this value as a signed short integer. This type conversion introduces a classic boundary error where values at or above 32768 are interpreted as negative numbers due to sign extension limitations inherent in signed sixteen-bit integers.
This misinterpretation leads directly to an unsafe memory allocation request within the module’s internal allocator, mymalloc(). The code subsequently casts this negative integer value into an unsigned size_t type for the purpose of determining buffer sizes. In most standard two's complement arithmetic systems used by modern operating systems and programming languages like C and Perl, casting a large negative signed integer to an unsigned type results in a very large positive number close to SIZE_MAX, which is the maximum possible value for that data type. Consequently, the allocator attempts to reserve memory space equivalent to nearly four gigabytes on 32-bit systems or significantly more on 64-bit architectures.
The operational impact of this flaw is severe and immediate because standard system allocators typically fail when such massive contiguous blocks are requested due to insufficient virtual address space or physical memory availability. Rather than handling the allocation failure gracefully by returning an error code that allows the application to continue running, Imager’s allocator invokes exit(3). This function call terminates the entire Perl process unconditionally and without any possibility of exception handling or recovery mechanisms catching the event. For applications relying on Imager for image processing tasks such as web servers generating thumbnails or batch processors analyzing user-uploaded images, this results in a complete service outage whenever a maliciously crafted TGA file is processed.
From a security classification perspective, this vulnerability aligns with CWE-190 Integer Overflow Wrap-Around and CWE-400 Uncontrolled Resource Consumption. The root cause is an integer overflow that occurs during the interpretation of input data as a signed type instead of an unsigned one, leading to resource exhaustion via excessive allocation attempts. In terms of attack vectors, this falls under ATT&CK technique T1499 Endpoint Denial of Service, specifically categorized under Volume Scouring or Resource Exhaustion by Application Control Loop if viewed through the lens of application logic failure, though it is more accurately described as a direct denial of service via malformed input causing process termination.
Mitigation strategies primarily involve upgrading to Imager version 1.036 or later where this integer handling has been corrected to properly validate color map lengths against expected bounds before allocation attempts are made. For environments unable to immediately upgrade, defensive programming practices should be implemented at the application layer by validating file headers and metadata prior to passing them to the Imager library. Additionally, deploying runtime protection mechanisms such as process supervision tools that can restart crashed services or sandboxing image processing tasks in isolated containers with strict memory limits can help contain the impact of this vulnerability until a permanent patch is applied.