CVE-2026-13705: Imager for Perl Buffer Overflow Vulnerability

CVE-2026-13705 Overview

CVE-2026-13705 is a heap out-of-bounds read vulnerability in the Imager Perl module before version 1.032. The flaw resides in the bundled Imager::File::SGI reader, specifically in the read_rgb_16_rle function that processes 16-bit run-length encoded (RLE) SGI image data. A crafted SGI image passed to Imager->read triggers the over-read before the parser rejects the malformed input, which can crash the process. The vulnerability is tracked under CWE-125: Out-of-bounds Read.

Critical Impact
Processing an attacker-supplied SGI image through applications using vulnerable Imager versions can crash the Perl process, resulting in a denial-of-service condition against image-processing pipelines.

Affected Products

Imager Perl module versions before 1.032
The bundled Imager::File::SGI reader component (versions before 0.06)
Any Perl application invoking Imager->read on SGI files with a vulnerable Imager release

Discovery Timeline

2026-07-06 - CVE-2026-13705 published to the National Vulnerability Database
2026-07-06 - Vulnerability disclosed on the OpenWall oss-security mailing list
2026-07-06 - Last updated in the NVD database

Technical Details for CVE-2026-13705

Vulnerability Analysis

The vulnerability stems from an incorrect boundary check inside read_rgb_16_rle, the 16-bit RLE decoder in Imager::File::SGI. The function guards each literal run with if (count > data_left), where count represents a pixel count and data_left represents remaining bytes in the buffer. Because each 16-bit sample consumes two bytes, the copy loop reads inp[0] * 256 + inp[1] and advances two bytes per pixel. A run satisfying data_left / 2 < count <= data_left passes the guard but consumes 2 * count bytes, reading past the end of the allocated buffer. The 8-bit decoding path is unaffected because there one pixel maps to one byte, so the guard remains correct.

Root Cause

The root cause is a unit mismatch between the guarded quantity and the actual buffer consumption. The check compares a pixel count against a byte count without applying the two-byte sample multiplier required for 16-bit RLE data. This numeric boundary condition [CWE-125] allows a malformed literal run length to bypass validation while still exhausting the remaining input plus additional adjacent heap memory.

Attack Vector

Exploitation requires an attacker to supply a crafted SGI image to a target that uses Imager to decode it. Because the trigger is file-based and requires user interaction to open or process the image, the CVSS vector is AV:L/UI:R. The read overflow discloses no attacker-controlled data path to memory disclosure primitives in the current write-up; the observed impact is a process crash, mapping to high availability impact.

text

// Patch manifest additions from the upstream fix
 SGI/t/10read.t
 SGI/t/20write.t
 SGI/t/30limit.t			Test size limit checking
+SGI/testimg/overflow.rgb
 SGI/testimg/rle.rgb
 SGI/testimg/rle12.rgb
 SGI/testimg/rle16.rgb

Source: GitHub patch commit f28de02

text

// SGI/SGI.pm version bump accompanying the buffer read overflow fix
 use Imager;
 
 BEGIN {
-  our $VERSION = "0.05";
+  our $VERSION = "0.06";
   
   require XSLoader;
   XSLoader::load('Imager::File::SGI', $VERSION);

Source: GitHub patch commit f28de02

Detection Methods for CVE-2026-13705

Indicators of Compromise

Unexpected termination or segmentation faults of Perl processes that invoke Imager->read on .rgb, .sgi, .bw, or .rgba files.
Presence of SGI images containing 16-bit RLE literal runs where the run length exceeds half of the remaining scanline data.
Core dumps from image-processing workers correlated with recent uploads or ingestion of SGI-format assets.

Detection Strategies

Inventory Perl environments and identify installations of Imager with Imager::File::SGI version below 0.06 (bundled with Imager < 1.032).
Instrument image-processing services with AddressSanitizer or Valgrind in test environments to detect the heap-buffer-overflow read when parsing suspect SGI samples.
Add file-type validation logging at ingestion points to record SGI file submissions for retrospective review.

Monitoring Recommendations

Alert on repeated crashes of image-conversion daemons, webhook workers, or CGI handlers that invoke Imager.
Monitor upload pipelines for SGI files with anomalous header dimensions or oversized RLE row tables.
Correlate application crash telemetry with recent file-upload events to identify targeted delivery of crafted images.

How to Mitigate CVE-2026-13705

Immediate Actions Required

Upgrade Imager to version 1.032 or later, which ships Imager::File::SGI0.06 containing the corrected bounds check.
Audit dependent Perl applications and CPAN bundles for pinned Imager versions and update lock files accordingly.
Restrict or reject SGI-format uploads at application boundaries until patching is complete.

Patch Information

The upstream fix is available as commit f28de02 in the Imager repository and is included in Imager 1.032. Release notes are documented in the MetaCPAN Changes file. Additional context was published to the OpenWall oss-security mailing list.

Workarounds

Disable SGI image handling in Imager-based workflows by filtering incoming file types before invoking Imager->read.
Sandbox image-decoding workers using process isolation, seccomp, or containerization to contain crashes and limit blast radius.
Run image processing under a supervisor that restarts crashed workers and rate-limits repeated failures from the same source.

bash

# Upgrade Imager to a patched release using cpanm
cpanm Imager@1.032

# Verify installed version and SGI reader version
perl -MImager -e 'print $Imager::VERSION, "\n"'
perl -MImager::File::SGI -e 'print $Imager::File::SGI::VERSION, "\n"'