---
id: CVE-2026-93019
title: >-
  Imager versions before 1.036 for Perl exit the process reading a TGA with a
  colour map length of 32768 or more in tga_palette_read.


  The reader unpacks the two-byte colour map length into a signed short, so a
  length of 32768 or more beco…
summary: >-
  Imager versions before 1.036 for Perl exit the process reading a TGA with a
  colour map length of 32768 or more in tga_palette_read.


  The reader unpacks the two-byte colour map length into a signed short, so a
  length of 32768 or more beco…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
cwe:
  - CWE-196
  - CWE-789
product: Imager
affected:
  - Imager < 1.036
published: '2026-09-18'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:18:17.967'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93019'
references:
  - url: >-
      https://github.com/tonycoz/imager/commit/74ed50e0625f9f51054e595bb4a8da92c1e0d571.patch
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://github.com/tonycoz/imager/security/advisories/GHSA-p4vw-rc54-p2c2'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://metacpan.org/release/TONYC/Imager-1.036/changes'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/18/9'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/tonycoz/imager/security/advisories/GHSA-p4vw-rc54-p2c2'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-18T17:28:31.210557Z'
ingestedAt: '2026-09-18T14:43:13.056Z'
epss: 0.00606
epssPercentile: 0.47366
---

## Overview

Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read.

The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tga_palette_read() casts that value to size_t and asks mymalloc() for a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3).

Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.