CVE-2026-112202

Medium

Description

Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected. The same code ships bundled in the Imager distribution. An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.

SeverityMedium

CVSS6.5

Exploit probability—

ProductImager

PublishedOct 20, 2026

First seenOct 20, 2026

Weakness typeCWE-125Out-of-bounds read

How to fix

Update

Imager1.040 or later
Imager-File-GIF1.006 or later

Patches

github.com/tonycoz/imager/commit/dec96f12b3d8a7fd94e86264953a5e4919dd6036.patch

Vendor advisories

Affected products

Product	Affected versions	Fixed in
Imager	v < 1.040	1.040
Imager-File-GIF	v < 1.006	1.006

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.