CVE-2026-93019

Critical

Description

Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read. The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tga_palette_read() casts that value to size_t and asks mymalloc() for a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3). Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.

SeverityCritical

CVSS9.1

Exploit probability—

ProductImager

PublishedSep 18, 2026

First seenSep 18, 2026

Weakness typeCWE-196CWE-196 CWE-789CWE-789

How to fix

Update

Imager1.036 or later

Patches

github.com/tonycoz/imager/commit/74ed50e0625f9f51054e595bb4a8da92c1e0d571.patch

Vendor advisories

Affected products

Product	Affected versions	Fixed in
Imager	v < 1.036	1.036

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.