CVE-2026-19082 Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags
HighCVSS 7.5
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags.
copy_string_tags() computes an ASCII EXIF tag's length as entry->size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry->size to 0, and the derived length reaches i_tags_add() as -1, which is interpreted as a request to call strlen(), scanning past the entry to the next NUL and copying those bytes into the tag. JPEG reaches this path via im_decode_exif(), as does the separate Imager::File::WEBP distribution, which is fixed by upgrading Imager.
Any caller of Imager->read() on an attacker-supplied image with such an entry may receive an exif_* tag holding adjacent heap bytes instead of an empty string.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| TONYC Imager | >= 0.45_02, < 1.034 | 1.034 |
| debian/libimager-perl(Debian:12) | All versions | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.019+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.019+dfsg-2 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.020+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.022+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.023+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.024+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.024+dfsg-2 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.025+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.027+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.028+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.029+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.030+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.031+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.032+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.033+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.034+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.034+dfsg-2 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.035+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.036+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.037+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.037+dfsg-2 | No fix listed |
| debian/libimager-perl(Debian:12) | = 1.040+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:13) | All versions | No fix listed |
Show 26 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libimager-perl(Debian:13) | = 1.027+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:13) | = 1.028+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:13) | = 1.029+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:13) | = 1.030+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:13) | = 1.031+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:13) | = 1.032+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:13) | = 1.033+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:13) | = 1.034+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:13) | = 1.034+dfsg-2 | No fix listed |
| debian/libimager-perl(Debian:13) | = 1.035+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:13) | = 1.036+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:13) | = 1.037+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:13) | = 1.037+dfsg-2 | No fix listed |
| debian/libimager-perl(Debian:13) | = 1.040+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:14) | < 1.034+dfsg-1 | 1.034+dfsg-1 |
| debian/libimager-perl(Debian:14) | = 1.027+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:14) | = 1.028+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:14) | = 1.029+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:14) | = 1.030+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:14) | = 1.031+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:14) | = 1.032+dfsg-1 | No fix listed |
| debian/libimager-perl(Debian:14) | = 1.033+dfsg-1 | No fix listed |
| ubuntu/libimager-perl(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/libimager-perl(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/libimager-perl(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/libimager-perl(Ubuntu:26.10) | All versions | No fix listed |
References
- github.com exploit vendor-advisory
- github.com patch
- metacpan.org release-notes
- www.openwall.com
- Debian Security Tracker CVE-2026-19082 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org