CVE-2026-93018

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-93018

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93018.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-93018

Aliases

GHSA-j7v7-cm4g-vrgf

Downstream

Published

2026-09-18T13:57:37Z

Modified

2026-09-24T08:22:21Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p

Details

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p.

The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without checking them against the colour map. i_gpix_p() rejects only an index greater than the count, so an index equal to it reads the first unpopulated entry, and getpixel() returns it.

i_glin_p() skips any index at or beyond the count without writing that pixel to the caller's buffer. The palette-to-RGB conversion reads each row through an uninitialised buffer, so those pixels of the converted image hold prior heap contents.

Reading an attacker-supplied image through Imager->read() and then fetching its pixels or converting it to RGB discloses process heap memory.

Database specific

{
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-193",
        "CWE-908"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93018.json"
}

References

Affected packages

Git / github.com/tonycoz/imager

Affected ranges

Type

GIT

Repo

https://github.com/tonycoz/imager

Events

Introduced

Fixed

0998bfbf88c1deeb080b9b07ec9ed9df6db5b363

Fixed

dcf0a52e2732399d42ab44d98af6934658d068ee

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.036"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

Imager-0.*

Imager-0.49

Imager-0.51_01

Imager-0.51_02

Imager-0.52

Imager-0.53

Imager-0.55

Imager-0.58

Imager-0.59

Imager-0.60

Imager-0.61

Imager-0.63

Imager-0.65

Imager-0.71

Imager-0.72

Imager-0.75

Imager-0.76

Imager-0.77

Imager-0.78

Imager-0.79

Imager-0.80

Imager-0.81

Imager-0.82

Other

Imager-0_38

Imager-0_38pre9

v0.*

v0.82_01

v0.83

v0.84

v0.84_01

v0.84_02

v0.85

v0.85_01

v0.85_02

v0.86

v0.87

v0.88

v0.89

v0.90

v0.91

v0.92

v0.93

v0.94

v0.94_01

v0.94_02

v0.95

v0.96

v0.96_01

v0.96_02

v0.97

v0.98

v0.99

v0.99_01

v0.99_02

v1.*

v1.000

v1.001

v1.002

v1.003

v1.004

v1.004_001

v1.004_002

v1.004_003

v1.004_004

v1.005

v1.006

v1.007

v1.008

v1.009

v1.010

v1.011

v1.012

v1.013

v1.014

v1.015

v1.016

v1.017

v1.018

v1.019

v1.020

v1.021

v1.022

v1.023

v1.024

v1.025

v1.026

v1.027

v1.028

v1.029

v1.030

v1.031

v1.032

v1.033

v1.034

v1.035

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93018.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "40022538085195695978728499375484456459",
            "length": 1339
        },
        "id": "CVE-2026-93018-1cc41bf6",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/dcf0a52e2732399d42ab44d98af6934658d068ee",
        "target": {
            "file": "palimg.c",
            "function": "im_img_pal_new"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "123505094870505756662050232534206530555",
            "length": 1706
        },
        "id": "CVE-2026-93018-40097387",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/dcf0a52e2732399d42ab44d98af6934658d068ee",
        "target": {
            "file": "PNG/impng.c",
            "function": "read_paletted"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "113912290250302637785939367359555217760",
                "210239576828354211120648300677010022499",
                "337521295668909689252074116719439876418",
                "123891981948284181127784884485949759179",
                "263577791069339444932821829774207164061"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-93018-662175e0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/dcf0a52e2732399d42ab44d98af6934658d068ee",
        "target": {
            "file": "PNG/impng.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "43457016399867416317385565640282286197",
                "221995265155974833274477276874726793564",
                "158458166060950823502165657356438917538",
                "153977578628663644201868709465952490934",
                "171944331312279255308416398415453600363",
                "290233710205467198691260830362915980331",
                "316693542740557772993380183925956455555",
                "118701682134981459728282115085957431993",
                "162094337558355969651674169779786346734",
                "142448981787113594943953402832915114528",
                "39524022451599756762778065757974891687",
                "163007655932505575313534766654804225029",
                "4293730668286354682886906716858214031",
                "246452826671707334087446167987774997390",
                "135907842194084061752088393638439913986",
                "312693204296186677836167573546694368281",
                "286158292568092530343252920114640244263",
                "320950385225095969986720440489254745936",
                "76368311313631903109212432281176669040",
                "210761666086003713219630274191374380950",
                "8612471725599225412037259366665001476",
                "15663837994916989868802558420689929065",
                "238712991678953378412580360295171124744",
                "105123671992250249719443080959937663805",
                "228418044598969573976732628072190512058",
                "247005940297160631377428539569580468744",
                "309532096180337561800848686507339301491",
                "157025272634790942623295959512812564695",
                "27696624591550921475400364799039921519",
                "197857948218835410324542762775218622418",
                "103773944678931345212499339020491079430",
                "270899068905923645524359730452912084857",
                "15510681824295841594904873455642614650",
                "124981263904848822346887922293135017254",
                "247005940297160631377428539569580468744",
                "261782431041098209066117910596901737420",
                "121849094446447658059018850399269297916",
                "256588484642147953218972628253703612196",
                "2330899236418482636100810315055886006",
                "40954977687481119322932614082001611904",
                "267883663034955152446326349778132208566",
                "172444564591308373461277889478916412972",
                "247365324945137497934141651852442886780",
                "108587633537507210242609878158511307392",
                "121849094446447658059018850399269297916",
                "256588484642147953218972628253703612196",
                "202450795143258813910248898048798300253",
                "169714220665848934407674631197035137632",
                "94633188803363829305862131032724877280",
                "191150541349295147698634484539130859365",
                "247365324945137497934141651852442886780",
                "108587633537507210242609878158511307392"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-93018-7b8c9d3c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/dcf0a52e2732399d42ab44d98af6934658d068ee",
        "target": {
            "file": "palimg.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "247825482935492151693505501258468738303",
            "length": 385
        },
        "id": "CVE-2026-93018-a12365c5",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/dcf0a52e2732399d42ab44d98af6934658d068ee",
        "target": {
            "file": "palimg.c",
            "function": "i_gpix_p"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "239798668248289038909907821052800418978",
            "length": 1327
        },
        "id": "CVE-2026-93018-bb4afb21",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/dcf0a52e2732399d42ab44d98af6934658d068ee",
        "target": {
            "file": "palimg.c",
            "function": "i_gsamp_p"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "66726046831655107263683715260853720777",
            "length": 596
        },
        "id": "CVE-2026-93018-f9481c6c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/dcf0a52e2732399d42ab44d98af6934658d068ee",
        "target": {
            "file": "palimg.c",
            "function": "i_glin_p"
        }
    }
]

vanir_signatures_modified

"2026-09-24T08:22:21Z"