Imager::File::GIF CVE-2026-8454

Exploitation requires processing of a specially crafted multi-frame GIF file where individual frame dimensions (Image.Width + Image.Left or Image.Height + Image.Top) exceed the file's declared global screen dimensions (SWidth or SHeight). The vulnerability triggers specifically in the skip-image code path at imgif.c lines 790-805 when the library processes but does not render certain frames. User interaction is required (UI:R) - the victim application must open and process the malicious GIF file, typically through file upload, email attachment processing, or local file operation. The vulnerability affects only the GIF-specific module, so applications must use Imager::File::GIF for GIF processing; those using alternative GIF libraries are not affected. Local attack vector (AV:L) means the attacker cannot exploit this remotely without first delivering the malicious file through separate means (phishing, compromised upload endpoint, supply chain injection of malicious image assets). No authentication required (PR:N) indicates no special application privileges are needed beyond normal file processing permissions.

Real-world risk is low despite the CWE-787 classification. CVSS 5.3 reflects the AV:L (local file access required), UI:R (user must open malicious GIF), and limited impact scope (C:L/I:L/A:L). EPSS score of 0.02% (5th percentile) indicates extremely low observed exploitation probability. No CISA KEV listing and no public exploit identified at time of analysis. Attack complexity is low (AC:L) but requires social engineering to deliver the malicious file and user interaction to process it, making this primarily a supply chain concern for applications that automatically process user-uploaded GIFs. The CVSS vector indicates PR:N (no authentication required) which in this context means no special privileges needed beyond convincing a user to open the file. For Perl web applications processing GIF uploads, this is a meaningful risk; for desktop Perl scripts processing trusted local files, risk is minimal. Patch availability in version 1.003 provides straightforward mitigation. Priority should be moderate for internet-facing Perl applications with GIF processing, low for internal tools.

An attacker crafts a malicious multi-frame GIF file with a global screen width of 100 pixels but includes a frame declaring width of 500 pixels with left offset causing the total to exceed buffer boundaries. When a Perl application using vulnerable Imager::File::GIF processes this file (e.g., web app thumbnail generation, image gallery processing), the skip-image code path calls DGifGetLine without validation, writing 400 bytes beyond the allocated heap buffer. This heap corruption could potentially be leveraged for code execution depending on heap layout, though the local attack vector and required user interaction limit practical exploitation to scenarios where attackers control processed image files.