{"id":"CVE-2026-93019","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-93019","summary":"Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read.\n\nThe reader unpacks the two-byte colour map length…","details":"Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read.\n\nThe reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tga_palette_read() casts that value to size_t and asks mymalloc() for a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3).\n\nReading an attacker-supplied file through Imager->read() triggers an uncatchable exit.","published":"2026-09-18T14:19:04.480","modified":"2026-09-18T14:19:04.480","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/tonycoz/imager/commit/74ed50e0625f9f51054e595bb4a8da92c1e0d571.patch","label":"tonycoz/imager@74ed50e"},"references":[{"type":"WEB","url":"https://github.com/tonycoz/imager/commit/74ed50e0625f9f51054e595bb4a8da92c1e0d571.patch"},{"type":"WEB","url":"https://github.com/tonycoz/imager/security/advisories/GHSA-p4vw-rc54-p2c2"},{"type":"WEB","url":"https://metacpan.org/release/TONYC/Imager-1.036/changes"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-18T14:19:04.480"}}