CVE-2026-93019

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-93019
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93019.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-93019
Aliases
  • GHSA-p4vw-rc54-p2c2
Downstream
Published
2026-09-18T13:58:12Z
Modified
2026-09-20T14:16:38Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
Summary
Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read
Details

Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read.

The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tga_palette_read() casts that value to size_t and asks mymalloc() for a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3).

Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.

Database specific 
{
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-196",
        "CWE-789"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93019.json"
}
References

Affected packages

Git / github.com/tonycoz/imager

Affected ranges

Type
GIT
Repo
https://github.com/tonycoz/imager
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0998bfbf88c1deeb080b9b07ec9ed9df6db5b363
Fixed
74ed50e0625f9f51054e595bb4a8da92c1e0d571
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.036"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

Imager-0.*
Imager-0.49
Imager-0.51_01
Imager-0.51_02
Imager-0.52
Imager-0.53
Imager-0.55
Imager-0.58
Imager-0.59
Imager-0.60
Imager-0.61
Imager-0.63
Imager-0.65
Imager-0.71
Imager-0.72
Imager-0.75
Imager-0.76
Imager-0.77
Imager-0.78
Imager-0.79
Imager-0.80
Imager-0.81
Imager-0.82
Other
Imager-0_38
Imager-0_38pre9
v0.*
v0.82_01
v0.83
v0.84
v0.84_01
v0.84_02
v0.85
v0.85_01
v0.85_02
v0.86
v0.87
v0.88
v0.89
v0.90
v0.91
v0.92
v0.93
v0.94
v0.94_01
v0.94_02
v0.95
v0.96
v0.96_01
v0.96_02
v0.97
v0.98
v0.99
v0.99_01
v0.99_02
v1.*
v1.000
v1.001
v1.002
v1.003
v1.004
v1.004_001
v1.004_002
v1.004_003
v1.004_004
v1.005
v1.006
v1.007
v1.008
v1.009
v1.010
v1.011
v1.012
v1.013
v1.014
v1.015
v1.016
v1.017
v1.018
v1.019
v1.020
v1.021
v1.022
v1.023
v1.024
v1.025
v1.026
v1.027
v1.028
v1.029
v1.030
v1.031
v1.032
v1.033
v1.034
v1.035

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93019.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "119948345469915638569348087927868827618",
            "length": 502
        },
        "id": "CVE-2026-93019-14a1ff64",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/74ed50e0625f9f51054e595bb4a8da92c1e0d571",
        "target": {
            "file": "tga.c",
            "function": "tga_palette_read"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "32324677314543486981969793054927867235",
            "length": 4593
        },
        "id": "CVE-2026-93019-869c7912",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/74ed50e0625f9f51054e595bb4a8da92c1e0d571",
        "target": {
            "file": "tga.c",
            "function": "i_readtga_wiol"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "24946389818946548069221690372982306004",
                "182554853386631873384112473511712900606",
                "121304537076147117392518683094948683863",
                "10697463712083602093601633256085249595",
                "169276710584266300954670119928371765706",
                "32672159156021958408210554188298091570",
                "281505376526195858191462224897644935040",
                "214001710070586363545498430646794677202",
                "114138852707116573699874210189218068930",
                "154806021498833700176078912935005320237",
                "231988174533561744030175204268508883925",
                "164973520376161982860861450517983646012",
                "333008643965020099912947596149461101244",
                "290758978354504958713077775810040708511",
                "35841989655964752405684908082386329629",
                "321431990062157093310062504083217365173",
                "242497929311088161972344482418094718546",
                "169490625944038890503731656728934781466",
                "22065108935528457696630906677665878327",
                "114103626073744946411598714635683250717",
                "289146296495894907069756397760616148523",
                "213669977378289977853669614250714802859",
                "235494019502903477543433257223656011799",
                "250299292333206135467751777350640812988",
                "169604728076340597579856802727417147107",
                "323728002856011741762493146324416679361",
                "56307087588183969048848314756518608027"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-93019-ecca6ae3",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/tonycoz/imager/commit/74ed50e0625f9f51054e595bb4a8da92c1e0d571",
        "target": {
            "file": "tga.c"
        }
    }
]
vanir_signatures_modified 
"2026-09-20T14:16:38Z"