CVE-2026-93019: Imager for Perl DOS Vulnerability

CVE-2026-93019 Overview

CVE-2026-93019 affects Imager versions before 1.036 for Perl. The vulnerability resides in the tga_palette_read() function, which mishandles Truevision TGA (Targa) files containing a color map length of 32768 or more. Parsing an attacker-controlled TGA file through Imager->read() triggers an uncatchable process exit, terminating the calling Perl application. The flaw is categorized as an incorrect signed-to-unsigned conversion [CWE-196] and impacts any service that ingests untrusted image data through Imager.

Critical Impact
A single malformed TGA file causes an uncatchable exit(3) in the host Perl process, enabling remote denial of service against web applications, image processors, and batch pipelines that use Imager.

Affected Products

Imager for Perl versions prior to 1.036
Perl applications invoking Imager->read() on untrusted TGA input
Downstream services and CPAN modules that depend on vulnerable Imager releases

Discovery Timeline

2026-09-18 - CVE-2026-93019 published to the National Vulnerability Database
2026-09-18 - Openwall OSS-Security disclosure posted
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-93019

Vulnerability Analysis

The defect lives in Imager's TGA decoder, specifically tga_palette_read(). The reader unpacks the two-byte color map length field into a signed short. Any value of 32768 or greater wraps to a negative number under two's complement interpretation. The negative value is then cast to size_t for the allocation request, producing a value near SIZE_MAX. Imager's mymalloc() allocator responds to the failed allocation by calling exit(3) rather than returning an error. Because exit(3) terminates the process immediately, the calling Perl program cannot trap the failure with eval or any signal handler.

Root Cause

The root cause is an improper signed-to-unsigned integer conversion [CWE-196] combined with a fatal allocator policy. The TGA color map length field is 16 bits and inherently unsigned in the file format, but Imager decoded it into a signed short. The subsequent cast produced a gigantic allocation request that mymalloc() treats as unrecoverable.

Attack Vector

An attacker crafts a TGA file with a color map length field set to any value between 0x8000 and 0xFFFF. Delivering that file to any workflow that calls Imager->read() on user-supplied images is sufficient to terminate the Perl process. Common exposure points include image upload endpoints, thumbnail generators, mail processors, and CI pipelines. No authentication or user interaction is required beyond submitting the file.

text

 Imager release history.  Older releases can be found in Changes.old
 
+ - TGA:
+   - don't interpret large color map sizes as negative.
+     this would lead to an attempt a very large allocation which would
+     fail, and the Imager would exit().
+     https://github.com/tonycoz/imager/security/advisories/GHSA-p4vw-rc54-p2c2
+
 Imager 1.035 - 19 August 2026
============

Source: GitHub Patch Commit 74ed50e

The patch note documents the fix in the Imager 1.036 changelog: the TGA reader no longer interprets large color map sizes as negative values, preventing the oversized allocation and the resulting exit().

Detection Methods for CVE-2026-93019

Indicators of Compromise

Unexpected termination of Perl worker processes immediately after processing an uploaded or received TGA file.
Web server or job queue logs showing image upload requests followed by worker crashes without a Perl exception trace.
TGA files with a color map length field (bytes 6-7 of the TGA header) whose little-endian value is >= 0x8000.

Detection Strategies

Inspect ingested TGA headers at the application boundary and reject files whose color map length exceeds 32767 entries.
Enumerate installed CPAN packages across servers and flag any Imager release earlier than 1.036.
Correlate process exit events on image-processing hosts with request logs to identify malicious uploads.

Monitoring Recommendations

Monitor Perl process lifecycle metrics on image-processing services for abnormal exit(3) terminations.
Alert on repeated worker restarts in FastCGI, PSGI, or job-runner supervisors following file uploads.
Track CPAN dependency inventories and generate alerts when hosts run Imager versions below 1.036.

How to Mitigate CVE-2026-93019

Immediate Actions Required

Upgrade Imager to version 1.036 or later on every host that processes untrusted images.
Audit application code paths that invoke Imager->read() on user-supplied files and add pre-validation.
Restrict accepted image formats at upload boundaries where TGA support is not required.

Patch Information

The fix is committed upstream as 74ed50e0625f9f51054e595bb4a8da92c1e0d571 and shipped in Imager 1.036. Refer to the GitHub Security Advisory GHSA-p4vw-rc54-p2c2 and the MetaCPAN Release Changes for release notes. Additional disclosure context is available in the Openwall OSS-Security Post.

Workarounds

Disable TGA decoding by omitting the format from Imager->read(type => ...) calls or by filtering by file signature before invocation.
Isolate image parsing in a short-lived subprocess so an uncatchable exit() does not terminate the parent service.
Reject TGA files larger than the expected size envelope or with a color map length field above 32767 at an upstream proxy or WAF.

bash

# Upgrade Imager from CPAN to the patched release
cpanm Imager@1.036

# Or with cpan client
cpan TONYC/Imager-1.036.tar.gz

# Verify installed version
perl -MImager -e 'print $Imager::VERSION, "\n"'