What is the CVSS score of EUVD-2026-41872?

EUVD-2026-41872 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Imager are affected by EUVD-2026-41872?

The Perl Imager module versions before 1.032 contain a heap buffer read vulnerability in SGI image processing that enables denial-of-service attacks, risking service unavailability for applications…. A patch is available.

How to fix or mitigate EUVD-2026-41872?

Within 24 hours: Identify and inventory all systems running Perl Imager module, documenting version numbers and deployment scope. Within 7 days: Deploy Perl Imager version 1.032 or later to all affected systems, testing in non-production environments first. Within 30 days: Verify patch deployment across the entire environment and confirm no systems remain on vulnerable versions before 1.032.

Imager EUVD-2026-41872

| CVE-2026-13705 HIGH

Out-of-bounds Read (CWE-125)

2026-07-06 9b29abf9-4ab0-4765-b253-1875cd9b441e

GHSA-pmgh-mrwc-qw67

Buffer Overflow Information Disclosure

7.1

CVSS 3.1 · Vendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Severity by source

Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

vuln.today AI

6.1 MEDIUM

Local file must be fed to the parser (AV:L, UI:R, PR:N); dominant impact is a crash (A:H), with only limited over-read exposure (C:L) and no integrity effect.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e).

CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 20:23 vuln.today

CVSS changed

Jul 06, 2026 - 20:22 NVD

7.1 (HIGH)

Patch available

Jul 06, 2026 - 14:02 EUVD

CVE Published

Jul 06, 2026 - 13:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle.

read_rgb_16_rle guards each literal run with if (count > data_left), but count is a pixel count while every 16-bit sample consumes two bytes. The copy loop reads inp[0] * 256 + inp[1] and advances two bytes per pixel, so a run with data_left / 2 < count <= data_left passes the guard yet consumes 2 * count bytes and reads past the end of the buffer. The 8-bit path is unaffected because there one pixel is one byte.

Reading a crafted SGI image through Imager->read triggers the over-read before the parser rejects the malformed image, which can crash the process.

AnalysisAI

Heap out-of-bounds read in the Perl Imager module (versions before 1.032) lets a crafted SGI image over-read past a decode buffer and crash the process. The flaw lives in the bundled Imager::File::SGI reader's read_rgb_16_rle routine, where a 16-bit RLE literal run is length-checked in pixels but consumed as two bytes per pixel, defeating the bounds guard. No public exploit is identified at time of analysis and it is not listed in CISA KEV; a vendor patch shipped in 1.032.

Technical ContextAI

Imager is a widely-used CPAN image-processing library for Perl that bundles format-specific readers, including Imager::File::SGI for the SGI/RGB image format. The root cause is CWE-125 (out-of-bounds read): in read_rgb_16_rle, each literal RLE run is validated with 'if (count > data_left)', but count expresses a pixel count while each 16-bit sample is decoded as inp[0]*256 + inp[1], advancing two bytes per pixel. Any run where data_left/2 < count <= data_left passes the guard yet consumes 2*count bytes, reading beyond the input buffer. The 8-bit RLE path is not affected because there one pixel maps to exactly one byte, so the pixel count and byte count coincide.

RemediationAI

Upgrade to Imager 1.032 or later, which contains the fix - Vendor-released patch: version 1.032, corresponding to upstream commit f28de02770dfc26ffbdc32048970ed84babbf730 (patch at https://github.com/tonycoz/imager/commit/f28de02770dfc26ffbdc32048970ed84babbf730.patch). Review the release notes at https://metacpan.org/release/TONYC/Imager-1.032/source/Changes and the disclosure at https://seclists.org/oss-sec/2026/q3/60. If you cannot immediately upgrade, avoid passing untrusted or attacker-controlled SGI images to Imager->read, or restrict accepted formats to exclude SGI/RGB in any image-upload pipeline; the trade-off is loss of SGI support for legitimate files. Where feasible, sandbox or resource-limit the process that decodes untrusted images so an over-read crash cannot take down a shared service.