EUVD-2026-41872
GHSA-pmgh-mrwc-qw67
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Local file must be fed to the parser (AV:L, UI:R, PR:N); dominant impact is a crash (A:H), with only limited over-read exposure (C:L) and no integrity effect.
Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e).
CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Lifecycle Timeline
4DescriptionCVE.org
Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle.
read_rgb_16_rle guards each literal run with if (count > data_left), but count is a pixel count while every 16-bit sample consumes two bytes. The copy loop reads inp[0] * 256 + inp[1] and advances two bytes per pixel, so a run with data_left / 2 < count <= data_left passes the guard yet consumes 2 * count bytes and reads past the end of the buffer. The 8-bit path is unaffected because there one pixel is one byte.
Reading a crafted SGI image through Imager->read triggers the over-read before the parser rejects the malformed image, which can crash the process.
AnalysisAI
Heap out-of-bounds read in the Perl Imager module (versions before 1.032) lets a crafted SGI image over-read past a decode buffer and crash the process. The flaw lives in the bundled Imager::File::SGI reader's read_rgb_16_rle routine, where a 16-bit RLE literal run is length-checked in pixels but consumed as two bytes per pixel, defeating the bounds guard. No public exploit is identified at time of analysis and it is not listed in CISA KEV; a vendor patch shipped in 1.032.
Technical ContextAI
Imager is a widely-used CPAN image-processing library for Perl that bundles format-specific readers, including Imager::File::SGI for the SGI/RGB image format. The root cause is CWE-125 (out-of-bounds read): in read_rgb_16_rle, each literal RLE run is validated with 'if (count > data_left)', but count expresses a pixel count while each 16-bit sample is decoded as inp[0]*256 + inp[1], advancing two bytes per pixel. Any run where data_left/2 < count <= data_left passes the guard yet consumes 2*count bytes, reading beyond the input buffer. The 8-bit RLE path is not affected because there one pixel maps to exactly one byte, so the pixel count and byte count coincide.
RemediationAI
Upgrade to Imager 1.032 or later, which contains the fix - Vendor-released patch: version 1.032, corresponding to upstream commit f28de02770dfc26ffbdc32048970ed84babbf730 (patch at https://github.com/tonycoz/imager/commit/f28de02770dfc26ffbdc32048970ed84babbf730.patch). Review the release notes at https://metacpan.org/release/TONYC/Imager-1.032/source/Changes and the disclosure at https://seclists.org/oss-sec/2026/q3/60. If you cannot immediately upgrade, avoid passing untrusted or attacker-controlled SGI images to Imager->read, or restrict accepted formats to exclude SGI/RGB in any image-upload pipeline; the trade-off is loss of SGI support for legitimate files. Where feasible, sandbox or resource-limit the process that decodes untrusted images so an over-read crash cannot take down a shared service.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today