CVE-2026-13705: Imager SGI Heap Buffer Over-Read DoS Vulnerability

Technical summary

The vulnerability resides in the read_rgb_16_rle function, which decompresses 16-bit RLE-encoded SGI image data. The guard check compares a pixel count against remaining bytes (data_left), but fails to account for the fact that each 16-bit pixel consumes two bytes. When a literal run has count values where data_left / 2 < count ≤ data_left, the validation passes but the subsequent copy loop reads 2 * count bytes, overrunning the buffer. The 8-bit variant is unaffected because it uses a 1:1 mapping between pixel count and byte consumption. The out-of-bounds read occurs during initial parsing before format validation can reject the malformed file, making exploitation straightforward.

Business impact

Any application or service that processes SGI images through Imager faces denial-of-service risk. Crash events could disrupt automated image processing pipelines, document conversion services, or graphic design workflows. While the vulnerability does not enable code execution, the high severity reflects both the ease of triggering a crash and the potential for information disclosure through leaked heap memory. Organizations depending on Imager for user-submitted or externally-sourced images should treat this as a near-term operational risk.

Affected systems

Imager versions before 1.032 for Perl are affected. The vulnerability is specific to SGI format handling and the 16-bit RLE code path, so applications must both (1) link Imager and (2) attempt to parse SGI files to be exploitable. Web services, batch processors, and desktop tools using Imager for image manipulation are typical targets.

Exploitability

Exploitation requires only a crafted SGI image file and a user or automated process that triggers Imager->read() on it. No special privileges or network access are needed; a malicious image sent via email, uploaded to a web form, or placed in a shared folder will trigger the crash. The flaw is deterministic and reliable. However, practical impact depends on whether the target actually processes SGI files—a common format in 3D graphics and legacy CAD workflows but less so in general web image processing.

Remediation

Update Imager to version 1.032 or later. Verify the update through your package manager (typically cpan or your distribution's Perl library repository). If immediate patching is not feasible, restrict SGI file processing or implement input validation to reject SGI images from untrusted sources until the patch is deployed.

Patch guidance

Upgrade Imager to 1.032 or later via CPAN using 'cpan Imager' or 'perl -m CPAN -e "install Imager"', or through your operating system's package manager if available. Verify the installed version with 'perl -MImager -e "print $Imager::VERSION"'. Test the patch in a development environment before deploying to production image processing services.

Detection guidance

Monitor for unexpected process crashes in applications using Imager, especially those with verbose logging of file-open operations. If SGI image parsing triggers segmentation faults or heap corruption messages, investigate recent image uploads or file additions. Intrusion detection can flag attempts to upload .sgi files to web forms, though this is only a weak signal without evidence of Imager processing. Review application logs for Imager errors tied to SGI file operations.

Why prioritize this

This vulnerability merits prompt attention because it combines a high CVSS score (7.1), ease of exploitation (no interaction beyond file opening), and reliability of the crash trigger. While not a code-execution flaw, denial-of-service through memory corruption can degrade availability and may leak sensitive heap data. Organizations processing any SGI images—particularly those in 3D, CAD, or graphics-intensive domains—should prioritize patching within 1–2 weeks.

Risk score, explained

CVSS 7.1 (HIGH) reflects the out-of-bounds read severity (CWE-125), high confidentiality impact from potential heap leakage, high availability impact from process crashes, and low barriers to exploitation (local attack vector, no privileges, user interaction only for file opening, which is normal application behavior). The score appropriately reflects that while code execution is not possible, confidentiality and availability harm is probable.

Frequently asked questions