/ 
Imager-1.036
⭐ Starred 27 / Imager::Security
Security Advisories (3)
CVE-2026-102504 (2026-10-01)

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large count requests an excessive allocation. When it fails, Imager's allocator calls exit(3). Passing an untrusted raw_datachannels value to Imager->read() triggers an uncatchable exit.

CVE-2026-102505 (2026-10-01)

Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every requested channel of each pixel into it. Requesting more than one channel writes past its end. An attacker-supplied image controls the overflowing bytes through its palette.

CVE-2026-112202 (2026-10-20)

Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected. The same code ships bundled in the Imager distribution. An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.

NAME

Imager::Security - brief notes on security and image processing

SYNOPSIS

# keep abreast of security updates
apt-get update && apt-get upgrade
yum upgrade
pkgin update && pkgin upgrade
# or local equivalent

# limit memory use
use Imager;
# only images that use up to 10MB
Imager->set_file_limits(bytes => 10_000_000);

DESCRIPTION

There's two basic security considerations when dealing with images from an unknown source:

  • keeping your libraries up to date

  • limiting the amount of memory used to store images

Keeping libraries up to date

Image file format libraries such as libpng or libtiff have relatively frequent security updates, keeping your libraries up to date is basic security.

If you're using user supplied fonts, you will need to keep your font libraries up to date too.

Limiting memory used

With compression, and especially with pointer formats like TIFF, it's possible to store very large images in a relatively small file.

If you're receiving image data from an untrusted source you should limit the amount of memory that Imager can allocate for a read in image file using the set_file_limits() method.

Imager->set_file_limits(bytes => 10_000_000);

You may also want to limit the maximum width and height of images read from files:

Imager->set_file_limits(width => 10_000, height => 10_000,
                        bytes => 10_000_000);

This has no effect on images created without a file:

# succeeds
my $image = Imager->new(xsize => 10_001, ysize => 10_001);

You can reset to the defaults with:

Imager->set_file_limits(reset => 1);

AUTHOR

Tony Cook <tonyc@cpan.org>