Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-93018— Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p

Quick assessment

Affected
CVE-2026-93018
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Imager 1.036 之前版本中，在读取带有超出其颜色映射范围的像素索引的调色板图像时，会通过 和 泄露未初始化的堆内存。 详细描述： 调色板内存以未初始化状态分配，只有读取器实际写入的条目才算作已填充。TGA 文件读取器在存储像素索引时，未检查这些索引是否超出颜色映射的有效范围。 仅拒绝大于已填充条目数的索引，因此当索引等于该数值时，会读取第一个未填充的调色板条目， 函数随后返回该条目的值。 会跳过所有大于或等于已填充条目数的索引，且不会将这些像素写入调用方的缓冲区。当进行调色板到 RGB 的转换时，每行数据

AI Predicted 5.3 Difficulty: Moderate EPSS 0.18% · P8

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 1.036 affected

I. Basic Information for CVE-2026-93018

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p
Source: CVE Program / CVE List V5
Vulnerability Description
Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without checking them against the colour map. i_gpix_p() rejects only an index greater than the count, so an index equal to it reads the first unpopulated entry, and getpixel() returns it. i_glin_p() skips any index at or beyond the count without writing that pixel to the caller's buffer. The palette-to-RGB conversion reads each row through an uninitialised buffer, so those pixels of the converted image hold prior heap contents. Reading an attacker-supplied image through Imager->read() and then fetching its pixels or converting it to RGB discloses process heap memory.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对未经初始化资源的使用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 1.036 -

II. Public POCs for CVE-2026-93018

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93018

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-93018 (1)

Other References for CVE-2026-93018 (1)

IV. Related Vulnerabilities

Same weakness: CWE-908

V. Comments for CVE-2026-93018

No comments yet

Leave a comment