CVE-2026-19082: Perl Imager Information Disclosure Flaw

CVE-2026-19082 Overview

CVE-2026-19082 is an out-of-bounds read vulnerability [CWE-125] in the Imager module for Perl, affecting versions from 0.45_02 before 1.034. The flaw exists in copy_string_tags() within the EXIF parsing code path, where a zero-count ASCII EXIF entry causes a length underflow that triggers a strlen() over-read. Attackers supplying a crafted image to any caller of Imager->read() can leak adjacent heap bytes into exif_* tag values. JPEG files reach the vulnerable code through im_decode_exif(), and the Imager::File::WEBP distribution is also affected.

Critical Impact
Attacker-supplied images can trigger heap memory disclosure through EXIF tag parsing, potentially exposing sensitive process memory contents to callers of Imager->read().

Affected Products

Imager for Perl versions 0.45_02 through 1.033
Imager::File::WEBP distribution (fixed by upgrading Imager)
Any Perl application invoking Imager->read() on untrusted JPEG or WEBP images

Discovery Timeline

2026-08-07 - CVE-2026-19082 published to NVD
2026-08-07 - Security advisory GHSA-hx46-55wp-hv6m published
2026-08-07 - Disclosure sent to OpenWall oss-security list
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-19082

Vulnerability Analysis

The vulnerability resides in copy_string_tags() in imexif.c. For ASCII-typed EXIF entries, the function computes the string length as entry->size - 1 to strip the trailing NUL byte. When an attacker crafts an EXIF entry with entry->size set to 0, the subtraction produces -1 due to integer wraparound in the int length variable passed to i_tags_add().

The i_tags_add() function treats a length of -1 as a signal to compute the length itself via strlen(). The strlen() call scans past the intended entry boundary, reading heap memory until it encounters a NUL byte. Those adjacent heap bytes are then copied into the resulting exif_* tag value returned to the caller.

Root Cause

The root cause is a missing bounds check before decrementing the ASCII entry length. The code path assumes entry->size is at least 1 for ASCII types but does not validate this invariant against attacker-controlled EXIF metadata, resulting in an out-of-bounds read [CWE-125].

Attack Vector

Exploitation requires only that a target application process an attacker-supplied image through Imager->read(). This is a common pattern in web applications, mail scanners, and image conversion pipelines that accept user uploads. The attacker crafts a JPEG or WEBP file containing an EXIF Image File Directory entry with an ASCII type and a count of zero. When the image is parsed, the resulting exif_* tag holds leaked heap bytes that may be reflected back to the attacker via application responses, logs, or metadata storage.

        tag_index < tiff->ifd_size; ++tag_index, ++entry) {
     for (i = 0; i < map_count; ++i) {
       if (map[i].tag == entry->tag) {
-	int len = entry->type == ift_ascii ? entry->size - 1 : entry->size;
+	int len = entry->size;
+        if (entry->type == ift_ascii && len > 0)
+          --len;
 	i_tags_set(&im->tags, map[i].name,
 		   (char const *)(tiff->base + entry->offset), len);
 	break;

Source: GitHub Patch Commit

The patch replaces the unconditional decrement with a guarded decrement that only fires when len > 0, preventing the underflow to -1.

Detection Methods for CVE-2026-19082

Indicators of Compromise

Application logs or output containing exif_* tag values with non-printable or unexpected binary content
User-uploaded JPEG or WEBP files whose EXIF IFD entries contain ASCII-typed tags with a count field of 0
Unexpected content in stored image metadata fields extracted by Perl-based image processors

Detection Strategies

Inventory Perl environments for installed Imager versions below 1.034 using cpan -l or perl -MImager -e 'print $Imager::VERSION'
Scan image processing pipelines and CPAN dependency manifests for Imager and Imager::File::WEBP entries
Inspect EXIF parsing telemetry for anomalous tag values that contain binary noise instead of readable ASCII

Monitoring Recommendations

Log the versions of Perl modules loaded by production image handlers and alert on unpatched Imager versions
Monitor upload endpoints for image files with malformed EXIF structures using file inspection tools such as exiftool
Track outbound responses and stored metadata for image-derived fields containing entropy suggesting leaked memory

How to Mitigate CVE-2026-19082

Immediate Actions Required

Upgrade Imager to version 1.034 or later on all systems that process untrusted images
Rebuild or reinstall applications bundling Imager or Imager::File::WEBP to pick up the fixed dependency
Audit application code that stores or returns exif_* tag values and treat previously captured values as potentially sensitive

Patch Information

The fix is committed in 24bde0427a113264d53f45a9c29ae756d84c82fe and released in Imager 1.034. See the GitHub Security Advisory GHSA-hx46-55wp-hv6m and the MetaCPAN release changes for Imager 1.034 for full details. The OpenWall oss-security disclosure provides additional context.

Workarounds

Strip EXIF metadata from uploaded images before passing them to Imager using a pre-processing step
Restrict accepted image types or validate EXIF IFD entry sizes before invoking Imager->read()
Avoid exposing exif_* tag values to end users or storing them in logs until the patch is applied

bash

# Upgrade Imager via cpanm to the fixed release
cpanm Imager@1.034

# Verify the installed version
perl -MImager -e 'print $Imager::VERSION, "\n"'