{"id":"CVE-2026-13705","aliases":["DEBIAN-CVE-2026-13705","EUVD-2026-41872","GHSA-pmgh-mrwc-qw67","MGASA-2026-0284","UBUNTU-CVE-2026-13705"],"status":"published","title":"Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle","description":"Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle.\n\nread_rgb_16_rle guards each literal run with if (count \u003e data_left), but count is a pixel count while every 16-bit sample consumes two bytes. The copy loop reads inp[0] * 256 + inp[1] and advances two bytes per pixel, so a run with data_left / 2 \u003c count \u003c= data_left passes the guard yet consumes 2 * count bytes and reads past the end of the buffer. The 8-bit path is unaffected because there one pixel is one byte.\n\nReading a crafted SGI image through Imager-\u003eread triggers the over-read before the parser rejects the malformed image, which can crash the process.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00175,"percentile":0.06959,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-07-06T12:03:38Z","modified":"2026-10-28T10:45:47Z","fixes":[{"ecosystem":"Debian:14","package":"libimager-perl","fixed_in":["1.032+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.019+dfsg-1","1.019+dfsg-2","1.020+dfsg-1","1.022+dfsg-1","1.023+dfsg-1","1.024+dfsg-1","1.024+dfsg-2","1.025+dfsg-1","1.027+dfsg-1","1.028+dfsg-1","1.029+dfsg-1","1.030+dfsg-1","1.031+dfsg-1","1.032+dfsg-1","1.033+dfsg-1","1.034+dfsg-1","1.034+dfsg-2","1.035+dfsg-1","1.036+dfsg-1","1.037+dfsg-1","1.037+dfsg-2","1.040+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.027+dfsg-1","1.028+dfsg-1","1.029+dfsg-1","1.030+dfsg-1","1.031+dfsg-1","1.032+dfsg-1","1.033+dfsg-1","1.034+dfsg-1","1.034+dfsg-2","1.035+dfsg-1","1.036+dfsg-1","1.037+dfsg-1","1.037+dfsg-2","1.040+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.032+dfsg-1"}]}],"versions":["1.027+dfsg-1","1.028+dfsg-1","1.029+dfsg-1","1.030+dfsg-1","1.031+dfsg-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Imager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.0-1.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Imager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.0-2.2.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.003+dfsg-1","1.004+dfsg-1","1.004+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.005+dfsg-2build1","1.006+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.011+dfsg-1","1.011+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.012+dfsg-1build1","1.012+dfsg-2","1.012+dfsg-2build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.019+dfsg-2","1.020+dfsg-1","1.022+dfsg-1","1.023+dfsg-1","1.023+dfsg-1build1","1.023+dfsg-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.027+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.029+dfsg-1","1.031+dfsg-1","1.033+dfsg-1","1.035+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.027+dfsg-1","1.029+dfsg-1"]}],"products":[{"vendor":"tonyc","product":"imager"}],"references":[{"url":"https://github.com/tonycoz/imager/commit/f28de02770dfc26ffbdc32048970ed84babbf730.patch","tags":["patch","fix"]},{"url":"https://metacpan.org/release/TONYC/Imager-1.032/source/Changes","tags":["release-notes","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/06/3","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13705","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pmgh-mrwc-qw67"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13705.json","tags":["advisory"]},{"url":"https://github.com/tonycoz/imager","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-13705","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0284.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35848","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7QJU7MFFAP73YEH5YEG35EDMGSNOZ3O5/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/08/6","tags":["web"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/41572386/","tags":["web","report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/41637674/","tags":["web"]},{"url":"https://github.com/briandfoy/cpan-security-advisory/issues/167","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-13705","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13705","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-13705","title":"Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle","description":"Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle.\n\nread_rgb_16_rle guards each literal run with if (count \u003e data_left), but count is a pixel count while every 16-bit sample consumes two bytes. The copy loop reads inp[0] * 256 + inp[1] and advances two bytes per pixel, so a run with data_left / 2 \u003c count \u003c= data_left passes the guard yet consumes 2 * count bytes and reads past the end of the buffer. The 8-bit path is unaffected because there one pixel is one byte.\n\nReading a crafted SGI image through Imager-\u003eread triggers the over-read before the parser rejects the malformed image, which can crash the process.","status":"published","published":"2026-07-06T12:03:38.513Z","modified":"2026-07-06T19:24:38.327Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:19:49.885652Z"}],"euvd":[{"id":"EUVD-2026-41872","description":"Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle.\n\nread_rgb_16_rle guards each literal run with if (count \u003e data_left), but count is a pixel count while every 16-bit sample consumes two bytes. The copy loop reads inp[0] * 256 + inp[1] and advances two bytes per pixel, so a run with data_left / 2 \u003c count \u003c= data_left passes the guard yet consumes 2 * count bytes and reads past the end of the buffer. The 8-bit path is unaffected because there one pixel is one byte.\n\nReading a crafted SGI image through Imager-\u003eread triggers the over-read before the parser rejects the malformed image, which can crash the process.","status":"published","published":"2026-07-06T12:03:38Z","modified":"2026-07-06T19:24:38Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:12.791563Z"}],"ghsa":[{"id":"GHSA-pmgh-mrwc-qw67","title":"Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File:...","description":"Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle.\n\nread_rgb_16_rle guards each literal run with if (count \u003e data_left), but count is a pixel count while every 16-bit sample consumes two bytes. The copy loop reads inp[0] * 256 + inp[1] and advances two bytes per pixel, so a run with data_left / 2 \u003c count \u003c= data_left passes the guard yet consumes 2 * count bytes and reads past the end of the buffer. The 8-bit path is unaffected because there one pixel is one byte.\n\nReading a crafted SGI image through Imager-\u003eread triggers the over-read before the parser rejects the malformed image, which can crash the process.","status":"published","published":"2026-07-06T15:30:48Z","modified":"2026-07-06T21:31:44Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:09:18.163038Z"}],"nvd":[{"id":"CVE-2026-13705","description":"Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle.\n\nread_rgb_16_rle guards each literal run with if (count \u003e data_left), but count is a pixel count while every 16-bit sample consumes two bytes. The copy loop reads inp[0] * 256 + inp[1] and advances two bytes per pixel, so a run with data_left / 2 \u003c count \u003c= data_left passes the guard yet consumes 2 * count bytes and reads past the end of the buffer. The 8-bit path is unaffected because there one pixel is one byte.\n\nReading a crafted SGI image through Imager-\u003eread triggers the over-read before the parser rejects the malformed image, which can crash the process.","status":"published","published":"2026-07-06T13:16:32.447Z","modified":"2026-10-25T20:10:00.147Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:28.040501Z"}],"osv":[{"id":"CVE-2026-13705","title":"Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle","description":"Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle.\n\nread_rgb_16_rle guards each literal run with if (count \u003e data_left), but count is a pixel count while every 16-bit sample consumes two bytes. The copy loop reads inp[0] * 256 + inp[1] and advances two bytes per pixel, so a run with data_left / 2 \u003c count \u003c= data_left passes the guard yet consumes 2 * count bytes and reads past the end of the buffer. The 8-bit path is unaffected because there one pixel is one byte.\n\nReading a crafted SGI image through Imager-\u003eread triggers the over-read before the parser rejects the malformed image, which can crash the process.","status":"published","published":"2026-07-06T12:03:38.513Z","modified":"2026-10-28T10:45:47.855200807Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:57.354194Z"},{"id":"DEBIAN-CVE-2026-13705","description":"Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle.  read_rgb_16_rle guards each literal run with if (count \u003e data_left), but count is a pixel count while every 16-bit sample consumes two bytes. The copy loop reads inp[0] * 256 + inp[1] and advances two bytes per pixel, so a run with data_left / 2 \u003c count \u003c= data_left passes the guard yet consumes 2 * count bytes and reads past the end of the buffer. The 8-bit path is unaffected because there one pixel is one byte.  Reading a crafted SGI image through Imager-\u003eread triggers the over-read before the parser rejects the malformed image, which can crash the process.","status":"published","published":"2026-07-06T13:16:32.447Z","modified":"2026-10-26T12:02:56.180955824Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:51.374409Z"},{"id":"UBUNTU-CVE-2026-13705","description":"Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle. read_rgb_16_rle guards each literal run with if (count \u003e data_left), but count is a pixel count while every 16-bit sample consumes two bytes. The copy loop reads inp[0] * 256 + inp[1] and advances two bytes per pixel, so a run with data_left / 2 \u003c count \u003c= data_left passes the guard yet consumes 2 * count bytes and reads past the end of the buffer. The 8-bit path is unaffected because there one pixel is one byte. Reading a crafted SGI image through Imager-\u003eread triggers the over-read before the parser rejects the malformed image, which can crash the process.","status":"published","published":"2026-07-06T13:16:00Z","modified":"2026-10-17T12:58:45.740652025Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"MGASA-2026-0284","title":"Updated perl-Imager package fixes security vulnerabilities","description":"The updated package fixes security vulnerabilities:\nThe Imager package before 1.025 for Perl has a heap-based buffer\noverflow leading to denial of service, or possibly unspecified other\nimpact, when the trim() method is called on a crafted input image.\n(CVE-2024-53901)\nImager versions before 1.032 for Perl have a heap out-of-bounds read in\nthe bundled Imager::File::SGI reader via a 16-bit RLE literal run in\nread_rgb_16_rle. (CVE-2026-13705)\nImager::File::JPEG versions before 1.003 for Perl leak heap memory when\nreading a JPEG with repeated APP13 markers in i_readjpeg_wiol.\n(CVE-2026-13708)\nImager versions before 1.033 for Perl treat unsigned EXIF IFD entry\ncounts as signed. (CVE-2026-14454)\n","status":"published","published":"2026-07-20T19:06:32Z","modified":"2026-07-20T19:15:05.272142173Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}