CVE-2026-112202

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112202
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112202.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112202
Aliases
  • GHSA-v4hp-5h6w-9897
Downstream
Published
2026-10-20T22:37:43Z
Modified
2026-10-22T07:11:59Z
Summary
Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images
Details

Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images.

With gif_consolidate => 1, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected.

The same code ships bundled in the Imager distribution.

An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.

Database specific 
{
    "cna_assigner":  "CPANSec",
    "cwe_ids":  [
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112202.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "1.040"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/tonycoz/imager

Affected ranges

Type
GIT
Repo
https://github.com/tonycoz/imager
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7c2117a4a44f023b8d96b24e1ac9131cd17f8bbc
Fixed
dec96f12b3d8a7fd94e86264953a5e4919dd6036
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.006"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "dec96f12b3d8a7fd94e86264953a5e4919dd6036"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Imager-0.*
Imager-0.49
Imager-0.51_01
Imager-0.51_02
Imager-0.52
Imager-0.53
Imager-0.55
Imager-0.58
Imager-0.59
Imager-0.60
Imager-0.61
Imager-0.63
Imager-0.65
Imager-0.71
Imager-0.72
Imager-0.75
Imager-0.76
Imager-0.77
Imager-0.78
Imager-0.79
Imager-0.80
Imager-0.81
Imager-0.82
Other
Imager-0_38
Imager-0_38pre9
v0.*
v0.82_01
v0.83
v0.84
v0.84_01
v0.84_02
v0.85
v0.85_01
v0.85_02
v0.86
v0.87
v0.88
v0.89
v0.90
v0.91
v0.92
v0.93
v0.94
v0.94_01
v0.94_02
v0.95
v0.96
v0.96_01
v0.96_02
v0.97
v0.98
v0.99
v0.99_01
v0.99_02
v1.*
v1.000
v1.001
v1.002
v1.003
v1.004
v1.004_001
v1.004_002
v1.004_003
v1.004_004
v1.005

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112202.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "170814883782849579191520694405733065997",
                "199276641934433253024788418239375476511",
                "283175418814058842624268111237133388266",
                "221757634624080708271145706994775805069",
                "117925901988924888572830842519591787042",
                "205752746550047956803040376471637054664",
                "209003024355178154057116606542236658033",
                "285975330661277195033406009747504540912",
                "137150112655745917835578621907073450026",
                "86148429478962314023891377039839840828",
                "294850819620094448813308157040437301794",
                "263204047890929976889833629475543791937",
                "117925901988924888572830842519591787042",
                "205752746550047956803040376471637054664",
                "209003024355178154057116606542236658033",
                "285975330661277195033406009747504540912",
                "152785700517355888599487567283728084660",
                "226267846333704046955166362286543610728",
                "135657149306255337918518605172071494068",
                "238183702941569482082434036558377835034"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-112202-96ea4915",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/tonycoz/imager/commit/dec96f12b3d8a7fd94e86264953a5e4919dd6036",
        "target":  {
            "file":  "GIF/imgif.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "19991145935402769927389255139650092817",
            "length":  5143
        },
        "id":  "CVE-2026-112202-9a2ce9f7",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/tonycoz/imager/commit/dec96f12b3d8a7fd94e86264953a5e4919dd6036",
        "target":  {
            "file":  "GIF/imgif.c",
            "function":  "i_readgif_low"
        }
    }
]
vanir_signatures_modified 
"2026-10-22T07:11:59Z"