EUVD-2026-82927Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft TGA with colourmaplength ≥ 32768
-
DeliverySubmit file to app using Imager->read()
-
ExploitSigned-short length becomes negative, cast to size_t
-
Executionmymalloc requests near-SIZE_MAX, allocation fails
-
PersistAllocator calls exit(3), process terminates
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Requires that the target application parse an attacker-supplied TGA image through Imager (Imager->read() with type 'tga' or content auto-detection) using a version before 1.036. No authentication, user interaction, or non-default configuration is needed on the Imager side - any code path that feeds untrusted image bytes to Imager is vulnerable. The key limiting factor is deployment context: exploitation only matters where Imager processes untrusted/uploaded files. The impact is amplified because the exit(3) is uncatchable - Perl eval/Try::Tiny cannot trap it - so a single malicious file kills the worker/process. No RCE or data exposure results. |
| Impact | The vendor CVSS of 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) overstates real risk: the described defect is a signed-short integer signedness error (CWE-196) in tga_palette_read() that produces a near-SIZE_MAX allocation, which fails and triggers Imager's allocator to call exit(3). This is a pure availability/denial-of-service issue - the process terminates uncatchably. There is NO confidentiality impact, so the vendor's C:H is unjustified; the true impact is A:H only, which drops the score to ~7.5. The Tags field ('Information Disclosure') and the vendor C:H conflict directly with the description, which shows only an uncatchable exit - verify with vendor, but the code evidence (allocator exit path, patch clamping colourmapusable) confirms DoS, not data leak. SSVC signals are moderate: Exploitation=poc, Automatable=yes, Technical Impact=partial - consistent with a reliable but non-catastrophic DoS. A proof-of-concept test file (testimg/badcmlen.tga) ships in the fixing commit, so working trigger data is public, but there is no CISA KEV listing and no EPSS score in the input, indicating no evidence of widespread active exploitation. Net: a genuine, trivially-reproducible DoS worth patching promptly where Imager parses untrusted images, but not a critical RCE/disclosure despite the 9.1 headline. |
| Exploit ScenarioDerived | An attacker uploads or otherwise supplies a crafted TGA file with a colour-map length field of 32768+ to a Perl web service or batch process that parses images via Imager->read(). When Imager unpacks the length into a signed short it becomes negative, is cast to size_t, and requests a near-SIZE_MAX buffer; the allocation fails and Imager's mymalloc calls exit(3), killing the process uncatchably (an eval/try block cannot recover). A public POC test asset (badcmlen.tga) exists in the fix commit, making reproduction trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
An attacker-supplied Truevision TGA image can force the Perl Imager module (versions before 1.036) to kill the entire hosting process: a colour map length of 32768 or more is read into a signed short, becomes negative, is cast to size_t, and turned into a near-SIZE_MAX allocation request that fails and makes Imager's allocator call exit(3). Exploitation requires only that the application pass untrusted image bytes to Imager->read() with TGA handling (explicit type 'tga' or auto-detection) - the CVSS vector is PR:N, so no authentication is needed, and the exit(3) is uncatchable, meaning Perl eval and Try::Tiny handlers cannot trap it and a single malicious file terminates the worker, request handler, or CLI process. Publicly available exploit code exists per the SSVC assessment (exploitation: poc), but the input does not record confirmed active exploitation (CISA KEV); the vendor CVSS of 9.1 (C:H/I:N/A:H) is overstated, since the independently assessed vector is C:N/I:N/A:H - this is a pure denial-of-service condition with no code execution, memory corruption, or data disclosure.
RemediationAI
Vendor-released patch: upgrade to Imager 1.036 or later (TONYC/Imager-1.036, https://metacpan.org/release/TONYC/Imager-1.036/changes), which contains commit 74ed50e0625f9f51054e595bb4a8da92c1e0d571 and is tracked by advisory GHSA-p4vw-rc54-p2c2; verify the deployed version with 'perl -MImager -e "print $Imager::VERSION"' after upgrading. If the upgrade cannot be applied immediately, the most effective compensating control is to stop feeding TGA data to the vulnerable decoder: restrict reads to known-safe formats by passing an explicit allow-list such as Imager->read(file => $f, type => 'png') or the module's 'types' option so auto-detection cannot select the TGA loader - the trade-off is that legitimate TGA assets will no longer be processed. A second option is to pre-screen uploads and reject any file whose TGA header bytes at offsets 5-6 (little-endian colour map length) exceed 255, since valid TGA colour maps are limited to 256 entries and the crashing condition requires 32768 or more - this is cheap and specific, but relies on your own parser being as strict as the patched decoder and will drop files with anomalously large (though legal-format) padding fields. Running Imager parsing in disposable worker processes supervised by a restart policy (for example a pool with per-request timeouts and automatic respawn) limits blast radius but does not prevent the crash itself. Note that a general RLIMIT_AS or memory cap is not a reliable mitigation here, because the failure path calls exit(3) before or regardless of whether the allocation is capped, and because exit(3) cannot be caught by eval, Try::Tiny, or similar in-process handlers.
Affected ProductsAI
Affected is the Imager CPAN distribution for Perl maintained by Tony Cook (TONYC), all versions before 1.036, on every platform where the module is built; the vulnerable code path is the TGA loader in tga.c reached through Imager->read(). The EUVD identifier EUVD-2026-82927 tracks the same issue as CVE-2026-93019. Downstream exposure is determined by the embedding application rather than by Imager itself: Perl CGI/PSGI web applications, thumbnail or conversion services, upload scanners, and any CLI tool that accepts attacker-supplied image files and allows TGA input (explicit type => 'tga' or automatic format detection) are affected, while installations that only ever decode trusted, vendor-generated images are not. No CPE strings were provided in the source data, so exact product coverage must be confirmed against the vendor advisory GHSA-p4vw-rc54-p2c2 and the 1.036 changelog on MetaCPAN; the upstream patch and changelog entries are at https://github.com/tonycoz/imager/commit/74ed50e0625f9f51054e595bb4a8da92c1e0d571.patch, https://github.com/tonycoz/imager/security/advisories/GHSA-p4vw-rc54-p2c2, and https://metacpan.org/release/TONYC/Imager-1.036/changes, with disclosure discussion at https://seclists.org/oss-sec/2026/q3/828 and http://www.openwall.com/lists/oss-security/2026/09/18/9.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a signedness bug (CWE-196, unsigned-to-signed conversion error) inside the TGA decoder of Imager for Perl, specifically tga_palette_read() in tga.c. The TGA header stores the colour map length as a two-byte little-endian field, which the decoder unpacked into a 'short int' struct member; any value of 32768 (0x8000) or above therefore became negative. That negative value was passed into mymalloc(), which takes a size_t, so the sign extension produced a request near SIZE_MAX, the allocation failed, and Imager's allocator handler responded by calling exit(3) rather than raising a trappable Perl exception. The upstream fix (commit 74ed50e0625f9f51054e595bb4a8da92c1e0d571, released in Imager 1.036) changes colourmaporigin, colourmaplength, x_origin and y_origin to unsigned types, passes colourmaporigin into tga_palette_read(), rejects an origin above 255 with an error, and clamps the usable palette to at most 256 entries (colourmapusable = 256 - colourmaporigin), silently discarding anything beyond entry 256 instead of attempting the doomed allocation. Note that the supplied tag 'Information Disclosure' is inconsistent with both the description and the independent assessment, which find availability impact only.
Know when Perl gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Untrusted TGA reachable remotely via image upload (AV:N/AC:L/PR:N/UI:N); impact is an uncatchable process exit, so A:H with C:N/I:N - no confidentiality or integrity effect.
Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e).
CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Lifecycle Timeline
2DescriptionCVE.org
Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read.
The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tga_palette_read() casts that value to size_t and asks mymalloc() for a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3).
Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.
Technical POC Analysis
CWE-196, Unsigned to Signed Conversion Error, as assigned by the advisory.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Perl Imager versions before 1.036 are affected by an unauthenticated denial-of-service flaw when processing malicious TGA images, and a single file can terminate the hosting process without being caught by normal Perl exception handling. Publicly available exploit code exists, and no vendor-released patch has been identified, so any service that passes untrusted image bytes to Imager with TGA support or auto-detection can experience repeated availability disruptions. Leadership should treat this as an availability-risk issue and direct teams to contain exposure in internet-facing and multi-tenant image-processing workflows first.
No vendor-released patch identified at time of analysis; interim mitigations include disabling TGA processing and auto-detection in Imager, rejecting or re-encoding untrusted TGA images before parsing, enforcing file-type allowlists and colour-map length checks, running image processing in isolated low-privilege, restartable workers or containers with resource limits, and monitoring for process exits.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive informa
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVS
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which mig
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers
The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-depe
Exploit-DB