CVE-2026-112202

Received Received - Intake

Out-of-Bounds Read in Imager Perl Module

Publication date: 2026-10-20

Last updated on: 2026-10-30

Assigner: CPANSec

Description

Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected. The same code ships bundled in the Imager distribution. An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-08

NVD

CVE-2026-112202

Affected Vendors & Products

Vendor	Product	Version / Range
imager	imager_file_gif	to 1.006 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability affects Imager::File::GIF versions before 1.006 for Perl. When the gif_consolidate option is enabled, the software reads palette indices from GIF images without verifying if they are within the color table's bounds. This causes out-of-bounds reads, leading to heap memory being read beyond allocated space and copied into output pixels. Attackers can exploit this to disclose adjacent heap memory or crash the process by providing a maliciously crafted GIF file.

Detection Guidance

This vulnerability can be detected by checking the version of Imager::File::GIF for Perl. If the version is below 1.006, the system is vulnerable. Commands like 'cpan Imager::File::GIF' or inspecting installed Perl modules may help identify the version.

Impact Analysis

If you use Imager::File::GIF versions before 1.006 with gif_consolidate enabled, an attacker could exploit this flaw to read sensitive data from memory or cause the application to crash. This may lead to information disclosure or denial-of-service conditions, depending on the context in which the library is used.

Mitigation Strategies

Immediately update Imager::File::GIF to version 1.006 or later. Disable the gif_consolidate option if it is enabled in your configuration. Review any applications using the Imager distribution for bundled vulnerable code.

Hi! I’m here to help you understand CVE-2026-112202. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...