Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-73638— Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd

Quick assessment

Affected
CVE-2026-73638
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Perl 版本的 Imager 中，从 0.45_02 到 1.032 之前的版本，由于在 中未检查起始偏移量，导致在读取 EXIF 块外部数据时发生越界读取。 通过验证 是否保持在 EXIF 块范围内来校验 IFD 条目的数据，但从未检查起始偏移量本身。当该和不等于数据真实结尾时，即使条目起始位置位于块外，校验仍会通过。 在 1.032 及之前版本中， 是普通的 类型，因此在常见的补码实现中，若偏移量的高位为 1，则会转换为负数，使得和值可能回落到块内。从 1.033 起，该字段变为 类型，仅在 为 32 位

AI Predicted 5.5 Difficulty: Hard

I. Basic Information for CVE-2026-73638

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd
Source: CVE Program / CVE List V5
Vulnerability Description
Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd. tiff_load_ifd() validates an IFD entry's data by checking that `entry->offset + entry->size` stays within the EXIF block, and never checks the start offset itself. Where that sum is not the real end of the data, the check passes with the entry starting outside the block. Through 1.032 `entry->offset` is a plain int, so on the usual two's-complement implementations an offset with the high bit set converts to negative and the sum can land back inside the block. From 1.033 the field is a size_t and the addition wraps only where size_t is 32 bits. The IFD's own start offset is checked the same way and wraps where unsigned long is 32 bits, which includes 64-bit Windows. Any caller of Imager->read() on an attacker-supplied image may receive EXIF tags holding bytes from outside the block, or crash the process.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0.45_02 ~ 1.035 -

II. Public POCs for CVE-2026-73638

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-73638

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-73638 (2)

Vendor Advisories for CVE-2026-73638 (1)

IV. Related Vulnerabilities

Same weakness: CWE-125

V. Comments for CVE-2026-73638

No comments yet

Leave a comment