CVE-2026-93019

Name	CVE-2026-93019
Description	Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read. The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tga_palette_read() casts that value to size_t and asks mymalloc() for a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3). Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libimager-perl (PTS)	bookworm	1.019+dfsg-1	vulnerable
	trixie	1.027+dfsg-1	vulnerable
	forky	1.036+dfsg-1	fixed
	sid	1.037+dfsg-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libimager-perl	source	(unstable)	1.036+dfsg-1

Notes

[trixie] - libimager-perl <no-dsa> (Minor issue)
[bookworm] - libimager-perl <postponed> (Minor issue; crafted TGA colour-map length makes the process exit)
https://lists.security.metacpan.org/cve-announce/msg/43654761/
https://github.com/tonycoz/imager/security/advisories/GHSA-p4vw-rc54-p2c2
Fixed by: https://github.com/tonycoz/imager/commit/74ed50e0625f9f51054e595bb4a8da92c1e0d571 (v1.036)