TONYC Imager::File::GIF up to 1.002 on Perl imgif.c i_readgif_multi_low out-of-bounds write

Summaryinfo

A vulnerability was found in TONYC Imager::File::GIF up to 1.002 on Perl and classified as critical. The affected element is the function i_readgif_multi_low of the file imgif.c. Such manipulation leads to out-of-bounds write. This vulnerability is uniquely identified as CVE-2026-8454. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in TONYC Imager::File::GIF up to 1.002 on Perl and classified as critical. Affected by this issue is the function i_readgif_multi_low of the file imgif.c. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Imager::File::GIF versions through 1.002 for Perl allow a heap out of bounds (OOB) write on crafted multi-frame GIF files. Imager::File::GIF's i_readgif_multi_low allocates a single per-row buffer GifRow sized for the GIF's global screen width 'SWidth' and reuses it across every image in the file. The page-match branch validates Image.Width + Image.Left > SWidth before each DGifGetLine write, but the parallel skip-image branch at imgif.c:790-805 calls DGifGetLine(GifFile, GifRow, Width) with no such check.

The advisory is shared for download at metacpan.org. This vulnerability is handled as CVE-2026-8454 since 05/13/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 05/21/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-30535). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• TONYC

Name

• Imager::File::GIF

Version

• 1.002

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion