CVE-2026-93018: Perl Imager Information Disclosure Vulnerability

CVE-2026-93018 Overview

CVE-2026-93018 is an information disclosure vulnerability in the Imager Perl module before version 1.036. The flaw exposes uninitialised heap memory when reading paletted images containing pixel indexes that exceed the colour map size. The i_gpix_p and i_glin_p functions return data from unpopulated palette entries, leaking process heap contents to the caller.

An attacker who supplies a crafted image processed through Imager->read() can force disclosure of prior heap contents when the application fetches pixels or converts the image to RGB. The vulnerability is classified under [CWE-193] (Off-by-one Error).

Critical Impact

Attackers can disclose sensitive process heap memory by supplying a malicious paletted image (such as a TGA file) to any application using vulnerable Imager versions.

Affected Products

• Imager Perl module versions before 1.036
• Applications processing untrusted images with Imager->read()
• Bundled Imager::File::PNG versions before 1.005

Discovery Timeline

• 2026-09-18 - CVE-2026-93018 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93018

Vulnerability Analysis

The Imager module allocates palette storage without initialising its entries. Only entries that a reader explicitly populates contain valid colour data. The TGA reader accepts pixel indexes without validating them against the actual number of populated palette entries, which sets up the disclosure path.

The i_gpix_p() function rejects only indexes strictly greater than the palette count. An index equal to the count reads the first unpopulated entry, and getpixel() returns whatever heap data occupied that memory. The i_glin_p() function skips indexes at or beyond the count without writing to the caller's buffer, so the palette-to-RGB conversion reads each row through an uninitialised buffer.

Root Cause

The root cause is an off-by-one comparison in palette index validation combined with allocation of the palette without zero-initialisation. The bounds check permits indexes equal to the count, treating an exclusive limit as inclusive.

Attack Vector

An attacker crafts a paletted image, typically TGA format, containing pixel indexes that reference positions beyond the declared colour map size. When the target application calls Imager->read() and then queries pixels or converts the image to RGB, the returned data contains uninitialised heap contents from the target process.

 if ($hsh{type} eq 'paletted' || $hsh{type} eq 'pseudo') {
     $self->{IMG} = i_img_pal_new($hsh{xsize}, $hsh{ysize}, $hsh{channels},
-                                 $hsh{maxcolors} || 256);
+                                 256);
   }

Source: GitHub Commit Patch. The patch forces palette allocation to a fixed size of 256 entries, ensuring that any out-of-range index falls within safely handled bounds where the fix returns black instead of leaking memory.

Detection Methods for CVE-2026-93018

Indicators of Compromise

• Unexpected image processing failures or anomalous pixel data in generated RGB conversions of user-supplied images.
• Uploaded paletted images (particularly TGA) with pixel index values that reference positions beyond the declared palette size.
• Applications returning image-derived output that contains binary noise or apparent memory fragments.

Detection Strategies

• Audit deployed Perl environments for Imager versions below 1.036 using cpan -l or equivalent package inventory tools.
• Inspect image processing pipelines that accept user uploads and pass them to Imager->read() followed by getpixel() or convert() calls.
• Static analysis of Perl codebases for calls into i_gpix_p and i_glin_p with untrusted image sources.

Monitoring Recommendations

• Log all image upload paths that invoke Imager and correlate with anomalous response sizes or content patterns.
• Monitor web application responses for image-processing endpoints returning unexpectedly large or entropy-inconsistent data.
• Alert on TGA and paletted PNG uploads to services not expected to receive them.

How to Mitigate CVE-2026-93018

Immediate Actions Required

• Upgrade Imager to version 1.036 or later on all systems processing untrusted images.
• Upgrade Imager::File::PNG to version 1.005 or later where installed as a separate distribution.
• Inventory all Perl applications that accept user-supplied images and prioritise patching those exposed to external input.

Patch Information

The fix is committed in the Imager repository as commit dcf0a52e2732399d42ab44d98af6934658d068ee and released in Imager 1.036. See the GitHub Security Advisory, the MetaCPAN Release Changes, and the Openwall OSS-Security Discussion for full technical context.

Workarounds

• Restrict accepted image formats to exclude TGA and other paletted formats until patching is complete.
• Validate and reject images where declared palette size does not match the referenced index range before passing them to Imager.
• Isolate image processing workloads in sandboxed processes with minimal sensitive data in memory.

# Upgrade Imager to the patched version via CPAN
cpan install TONYC/Imager-1.036.tar.gz

# Verify installed version
perl -MImager -e 'print $Imager::VERSION, "\n"'