Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112202— Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images

Quick assessment

Affected
CVE-2026-112202
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 Imager::File::GIF 模块在 1.006 版本之前存在越界读取漏洞，该漏洞发生在合并 GIF 图像的过程中。 当启用 选项时，系统会直接使用图像中的调色板索引，而不会检查其是否在颜色表的有效范围内。 例程因此会读取超出堆内存分配范围的字节，并将这些字节复制到输出像素中。默认的 GIF 读取器不受此问题影响。 相同代码也包含在 Imager 发行包中。 攻击者可通过提供特制的 GIF 文件，利用解码后的输出泄露相邻的堆内存数据，甚至导致进程崩溃。

AI Predicted 5.5 Difficulty: Easy

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

I. Basic Information for CVE-2026-112202

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images
Source: CVE Program / CVE List V5
Vulnerability Description
Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected. The same code ships bundled in the Imager distribution. An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 1.006 -
- - 0 ~ 1.040 -

II. Public POCs for CVE-2026-112202

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112202

请登录查看更多情报信息。

Other References for CVE-2026-112202 (4)

IV. Related Vulnerabilities

Same weakness: CWE-125

V. Comments for CVE-2026-112202

No comments yet

Leave a comment