DEBIAN-CVE-2026-8669

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-8669
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-8669.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-8669
Upstream
  • CVE-2026-8669
Published
2026-05-15T15:16:57.043Z
Modified
2026-05-16T09:01:59.267804Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Imager versions through 1.030 for Perl allow a heap out of bounds (OOB) write on crafted multi-frame GIF files. Imager::File::GIF's ireadgifmulti_low allocates a single per-row buffer GifRow sized for the GIF's global screen width 'SWidth' and reuses it across every image in the file. The page-match branch validates Image.Width + Image.Left > SWidth before each DGifGetLine write, but the parallel skip-image branch at imgif.c:790-805 calls DGifGetLine(GifFile, GifRow, Width) with no such check.

References

Affected packages

Debian:11 / libimager-perl

Package

Name
libimager-perl
Purl
pkg:deb/debian/libimager-perl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.012+dfsg-1
1.012+dfsg-2
1.015+dfsg-1
1.016+dfsg-1
1.018+dfsg-1
1.019+dfsg-1
1.019+dfsg-2
1.020+dfsg-1
1.022+dfsg-1
1.023+dfsg-1
1.024+dfsg-1
1.024+dfsg-2
1.025+dfsg-1
1.027+dfsg-1
1.028+dfsg-1
1.029+dfsg-1
1.030+dfsg-1
1.031+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-8669.json"

Debian:12 / libimager-perl

Package

Name
libimager-perl
Purl
pkg:deb/debian/libimager-perl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.019+dfsg-1
1.019+dfsg-2
1.020+dfsg-1
1.022+dfsg-1
1.023+dfsg-1
1.024+dfsg-1
1.024+dfsg-2
1.025+dfsg-1
1.027+dfsg-1
1.028+dfsg-1
1.029+dfsg-1
1.030+dfsg-1
1.031+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-8669.json"

Debian:13 / libimager-perl

Package

Name
libimager-perl
Purl
pkg:deb/debian/libimager-perl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.027+dfsg-1
1.028+dfsg-1
1.029+dfsg-1
1.030+dfsg-1
1.031+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-8669.json"

Debian:14 / libimager-perl

Package

Name
libimager-perl
Purl
pkg:deb/debian/libimager-perl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.027+dfsg-1
1.028+dfsg-1
1.029+dfsg-1
1.030+dfsg-1
1.031+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-8669.json"