CVE-2026-112202

Name	CVE-2026-112202
Description	Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected. The same code ships bundled in the Imager distribution. An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1151664

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libimager-perl (PTS)	bookworm	1.019+dfsg-1	vulnerable
	trixie	1.027+dfsg-1	vulnerable
	forky, sid	1.040+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libimager-perl	source	(unstable)	1.040+dfsg-1			1151664

Notes

[trixie] - libimager-perl <no-dsa> (Minor issue)
[bookworm] - libimager-perl <postponed> (Minor issue; can be fixed in next update)
https://lists.security.metacpan.org/cve-announce/msg/44514169/
https://github.com/tonycoz/imager/security/advisories/GHSA-v4hp-5h6w-9897
Fixed by: https://github.com/tonycoz/imager/commit/dec96f12b3d8a7fd94e86264953a5e4919dd6036 (v1.040)