CVE-2026-112202GHSA-v4hp-5h6w-9897
Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images
Imager::File::GIF
CVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images.
With gif_consolidate => 1, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected.
The same code ships bundled in the Imager distribution.
An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.
Text from GitHub Advisory Database
Affected versions 4
- Productaffected: all versions before 1.006CVE List
- Productaffected: all versions before 1.040CVE List
- Imager::File::GIF, cpan<= 1.005GitHub
- Imager, cpan<= 1.039GitHub
References 4
- github.com/tonycoz/imager/commit/dec96f12b3d8a7fd94e86264953a5e4919dd6036.patchFixvia CVE List
- github.com/tonycoz/imager/security/advisories/GHSA-v4hp-5h6w-9897Advisoryvia CVE List
- metacpan.org/release/TONYC/Imager-File-GIF-1.006/changesReferencevia CVE List
- metacpan.org/release/TONYC/Imager-1.040/changesReferencevia CVE List