Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-73639— Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8

Quick assessment

Affected
CVE-2026-73639
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Imager::File::PNG 模块中，在 Perl 环境下，从 1.003 版本开始到 1.004 之前的版本中，在 函数中读取包含 tRNS 透明度块的 PNG 图像时，会发生缓冲区溢出（写入超出行缓冲区的末尾）。 当存在 tRNS 块时， 会为生成的图像添加一个 Alpha 通道，但仍然根据原始通道数来分配行缓冲区的大小。由于 libpng 会将透明度信息扩展并填充到该额外的通道中，因此 会多填充一个通道（每个样本多写 1 字节），从而在分配缓冲区末尾之外多写 个字节。调色板图像会通过 处理，16 位图像

AI Predicted 6.5 Difficulty: Moderate EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProduct Version RangeStatus
None None 1.003< 1.004 affected
1.034< 1.035 affected

I. Basic Information for CVE-2026-73639

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8
Source: CVE Program / CVE List V5
Vulnerability Description
Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8. With a tRNS chunk, read_direct8() adds an alpha channel to the image it creates but still sizes the row buffer from the original channel count. libpng expands the transparency into that extra channel, so png_read_row() fills one channel more than the buffer holds, at one byte per sample, and writes width bytes past the end of the allocation. Palette images go to read_paletted() and 16-bit images to read_direct16(), which sizes its buffer from png_get_rowbytes() and allocates enough for the expanded row. The same reader ships bundled in the Imager distribution. Reading an attacker-supplied PNG through Imager->read() corrupts the heap, which can crash the process.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 1.003 ~ 1.004 -
- - 1.034 ~ 1.035 -

II. Public POCs for CVE-2026-73639

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-73639

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-73639 (2)

Vendor Advisories for CVE-2026-73639 (1)

Vendor Pages for CVE-2026-73639 (1)

IV. Related Vulnerabilities

Same weakness: CWE-787

V. Comments for CVE-2026-73639

No comments yet

Leave a comment