CVE catalog

CVE-2026-112202

libimager-perl: CVE-2026-112202

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.23% · Oct 25, 2026

Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected. The same code ships bundled in the Imager distribution. An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibimager-perlsid1.040+dfsg-1fixed
Debianlibimager-perlforky1.037+dfsg-2vulnerable
Debianlibimager-perltrixie1.027+dfsg-1vulnerable
Debianlibimager-perlbookworm1.019+dfsg-1vulnerable
Ubuntulibimager-perl16.041.003+dfsg-1vulnerable
Ubuntulibimager-perl16.041.004+dfsg-1vulnerable
Ubuntulibimager-perl16.041.004+dfsg-1build1vulnerable
Ubuntulibimager-perl18.041.005+dfsg-2build1vulnerable
Ubuntulibimager-perl18.041.006+dfsg-1vulnerable
Ubuntulibimager-perl20.041.011+dfsg-1vulnerable
Ubuntulibimager-perl20.041.011+dfsg-1build1vulnerable
Ubuntulibimager-perl22.041.012+dfsg-1build1vulnerable
Ubuntulibimager-perl22.041.012+dfsg-2vulnerable
Ubuntulibimager-perl22.041.012+dfsg-2build1vulnerable
Ubuntulibimager-perl24.041.019+dfsg-2vulnerable
Ubuntulibimager-perl24.041.020+dfsg-1vulnerable
Ubuntulibimager-perl24.041.022+dfsg-1vulnerable
Ubuntulibimager-perl24.041.023+dfsg-1vulnerable
Ubuntulibimager-perl24.041.023+dfsg-1build1vulnerable
Ubuntulibimager-perl24.041.023+dfsg-1build2vulnerable
Ubuntulibimager-perl26.101.029+dfsg-1vulnerable
Ubuntulibimager-perl26.101.031+dfsg-1vulnerable
Ubuntulibimager-perl26.101.033+dfsg-1vulnerable
Ubuntulibimager-perl26.101.035+dfsg-1vulnerable
Ubuntulibimager-perl26.041.027+dfsg-1vulnerable
Ubuntulibimager-perl26.041.029+dfsg-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibimager-perlsourcesid1.040+dfsg-1not yet assignedNot reported[1151664]
Debianlibimager-perlsourceforky(unfixed)not yet assignedNot reported[1151664]
Debianlibimager-perlsourcetrixie(unfixed)not yet assignedNot reported[1151664]
Debianlibimager-perlsourcebookworm(unfixed)not yet assignedNot reported[1151664]

[Debian bug #1151664]

Notes

[trixie] libimager-perl: Minor issue [bookworm] libimager-perl: Minor issue; can be fixed in next update

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libimager-perl]Affected

    Source package: [libimager-perl]

    Details (2)

    • 1.019+dfsg-1+b2 · amd64 · bookworm

      Affected

      dsa · libimager-perl · debian · bookworm; dsa · libimager-perl · debian · 12

    • 1.019+dfsg-1+b2 · arm64 · bookworm

      Affected

      dsa · libimager-perl · debian · bookworm; dsa · libimager-perl · debian · 12

[Debian 13 (Trixie)]

  • [libimager-perl]Affected
    Details (2)

    • 1.027+dfsg-1 · amd64 · trixie

      Affected

      dsa · libimager-perl · debian · 13

    • 1.027+dfsg-1 · arm64 · trixie

      Affected

      dsa · libimager-perl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]