CVE-2026-112202

Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected. The same code ships bundled in the Imager distribution. An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/tonycoz/imager/commit/dec96f12b3d8a7fd94e86264953a5e4919dd6036.patch
https://github.com/tonycoz/imager/security/advisories/GHSA-v4hp-5h6w-9897
https://metacpan.org/release/TONYC/Imager-1.040/changes
https://metacpan.org/release/TONYC/Imager-File-GIF-1.006/changes
http://www.openwall.com/lists/oss-security/2026/10/21/1

Configurations

No configuration.

History

30 Oct 2026, 13:18

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.5

21 Oct 2026, 03:17

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2026/10/21/1 -

20 Oct 2026, 23:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-20 23:17

Updated : 2026-10-30 13:18

NVD link : CVE-2026-112202

Mitre link : CVE-2026-112202

CVE.ORG link : CVE-2026-112202

JSON object : View

Products Affected

No product.

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-112202", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-112202", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T13:03:05.754103Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/tonycoz/imager", "modules": ["Imager::File::GIF"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.006", "versionType": "custom"}], "packageURL": "pkg:cpan/Imager-File-GIF", "packageName": "Imager-File-GIF", "programFiles": ["imgif.c"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "i_readgif_low"}]}, {"repo": "https://github.com/tonycoz/imager", "modules": ["Imager::File::GIF"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.040", "versionType": "custom"}], "packageURL": "pkg:cpan/Imager", "packageName": "Imager", "programFiles": ["GIF/imgif.c"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "i_readgif_low"}]}]}], "published": "2026-10-20T23:17:01.690", "references": [{"url": "https://github.com/tonycoz/imager/commit/dec96f12b3d8a7fd94e86264953a5e4919dd6036.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://github.com/tonycoz/imager/security/advisories/GHSA-v4hp-5h6w-9897", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/TONYC/Imager-1.040/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/TONYC/Imager-File-GIF-1.006/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/21/1", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images.\n\nWith `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected.\n\nThe same code ships bundled in the Imager distribution.\n\nAn attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process."}], "lastModified": "2026-10-30T13:18:28.917", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}