Log in Start free

Vulnerability · Published Oct 20, 2026 · Assigned by CPANSec

CVE-2026-112202Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images

Medium 6.5

In plain English

A medium-severity out-of-bounds read in Imager. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 63.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected. The same code ships bundled in the Imager distribution. An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libimager-perlno fix listedDEBIAN-CVE-2026-112202
Debian:13libimager-perlno fix listedDEBIAN-CVE-2026-112202
Debian:14libimager-perl1.040+dfsg-1DEBIAN-CVE-2026-112202
Ubuntu:22.04:LTSlibimager-perlno fix listedUBUNTU-CVE-2026-112202
Ubuntu:24.04:LTSlibimager-perlno fix listedUBUNTU-CVE-2026-112202
Ubuntu:26.04:LTSlibimager-perlno fix listedUBUNTU-CVE-2026-112202
Ubuntu:26.10libimager-perlno fix listedUBUNTU-CVE-2026-112202

Affected products (as reported)

VendorProductVersions
Imager-File-GIF 0 – before 1.006
Imager 0 – before 1.040

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

References