Read the docs
TI-2026-78639 Aliases CVE-2026-112202

Out-of-bounds reads in Imager::File::GIF when consolidating GIF images

Priority LOW 35CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Imager::File::GIF for Perl versions before 1.006 is affected. When gif_consolidate is enabled, palette indices are used without checking the colour table bounds, which causes an out-of-bounds read (CWE-125). An unauthenticated remote attacker who supplies a crafted GIF can disclose adjacent heap memory through the decoded output or crash the process. The same code is bundled in Imager before 1.040.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected. The same code ships bundled in the Imager distribution. An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00425 37th percentileScored 2026-11-07
Fix Fixed Imager-File-GIF: 1.006Imager: 1.040

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Imager-File-GIFbefore 1.0061.006Patch availableCNA
—Imagerbefore 1.0401.040Patch availableCNA
  • Imager-File-GIF Vendor— Affected before 1.006 Fixed in 1.006 Patch available CNA
  • Imager Vendor— Affected before 1.040 Fixed in 1.040 Patch available CNA

Remediation

Update Imager-File-GIF to version 1.006 and Imager to version 1.040.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA Imager-File-GIF Fixed in 1.006
  • Fix · CNA Imager Fixed in 1.040

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-112202
  2. 2026-10-30 CVSS score added · CISA ADP
  3. 2026-10-30 CISA SSVC decision points changed
  4. 2026-11-07 Affected versions changed · Red Hat
  5. 2026-11-07 CVSS score added · Red Hat

References

Patch 1

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences