oss-security - CVE-2026-8454: Imager::File::GIF versions through 1.002 for Perl allow a heap out of bounds (OOB) write on crafted multi-frame GIF files

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <b2d26d1ff711eeed1b43c8cd2a4ae838@cpansec.org>
Date: Fri, 15 May 2026 08:00:26 -0300
From: Timothy Legge <timlegge@...nsec.org>
To: Cve Announce <cve-announce@...urity.metacpan.org>, Oss Security
 <oss-security@...ts.openwall.com>
Subject: CVE-2026-8454: Imager::File::GIF versions through 1.002 for Perl
 allow a heap out of bounds (OOB) write on crafted multi-frame GIF files

========================================================================
CVE-2026-8454                                        CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-8454
   Distribution:  Imager-File-GIF
       Versions:  through 1.002

       MetaCPAN:  https://metacpan.org/dist/Imager-File-GIF
       VCS Repo:  https://github.com/tonycoz/imager


Imager::File::GIF versions through 1.002 for Perl allow a heap out of
bounds (OOB) write on crafted multi-frame GIF files

Description
-----------
Imager::File::GIF versions through 1.002 for Perl allow a heap out of
bounds (OOB) write on crafted multi-frame GIF files.

Imager::File::GIF's i_readgif_multi_low allocates a single per-row
buffer GifRow sized for the GIF's global screen width 'SWidth' and
reuses it across every image in the file.

The page-match branch validates Image.Width + Image.Left > SWidth
before each DGifGetLine write, but the parallel skip-image branch at
imgif.c:790-805 calls DGifGetLine(GifFile, GifRow, Width) with no such
check.

Problem types
-------------
- CWE-787 Out-of-bounds Write

Solutions
---------
Upgrade to Imager::File::GIF 1.003.


References
----------
https://metacpan.org/release/TONYC/Imager-File-GIF-1.003/source/Changes
https://github.com/tonycoz/imager/commit/782e9c06cc75a0f7eed383f39522f51f44598b04.patch

Timeline
--------
- 2026-05-12: Issue identified
- 2026-05-13: Issue reported to maintainer
- 2026-05-14: Maintainer acknowledged the report
- 2026-05-15: Fixed version released

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.