CVE-2026-93018

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without checking them against the colour map. i_gpix_p() rejects only an index greater than the count, so an index equal to it reads the first unpopulated entry, and getpixel() returns it. i_glin_p() skips any index at or beyond the count without writing that pixel to the caller's buffer. The palette-to-RGB conversion reads each row through an uninitialised buffer, so those pixels of the converted image hold prior heap contents. Reading an attacker-supplied image through Imager->read() and then fetching its pixels or converting it to RGB discloses process heap memory.

• CWE-193
• CWE-908

• https://github.com/tonycoz/imager/commit/dcf0a52e2732399d42ab44d98af6934658d068ee.patch
• https://github.com/tonycoz/imager/security/advisories/GHSA-j7v7-cm4g-vrgf
• https://metacpan.org/release/TONYC/Imager-1.036/changes
• https://www.openwall.com/lists/oss-security/2026/09/18/8

Published

Sep 18, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93011A flaw was found in dnsmasq. After a reduction of internal d…5.3
• CVE-2026-93012Email::Sender::Transport::Sendmail versions before 2.602 for…9.8
• CVE-2026-93013RAGFlow through 0.27.2 contains a path traversal vulnerabili…4.3
• CVE-2026-93014RosarioSIS versions before 12.9 fail to validate the filenam…7.1
• CVE-2026-93015BlueKitchen BTstack through 1.8.2 fails to validate the peer…6.3
• CVE-2026-93017The `insights-operator-gather` ClusterRole grants the operat…7.7
• CVE-2026-93019Imager versions before 1.036 for Perl exit the process readi…9.1
• CVE-2026-9302A vulnerability was determined in 546669204 vps-inventory-mo…6.3
• CVE-2026-93026This vulnerability in Veeam Backup & Replication allows a Ba…6.1
• CVE-2026-93029There is a stored XSS vulnerability allowing arbitrary code …9
• CVE-2026-9303A vulnerability was identified in calcom cal.diy up to 4.9.4…4.3
• CVE-2026-93030FTM 4.x ALL could allow a remote authenticated attacker to o…6.5