CVE-2026-73639

Overview

Imager::File::PNG versions prior to 1.004 in Perl can corrupt the heap when parsing a PNG containing a tRNS transparency chunk. The vulnerability arises from a buffer overflow during row decoding, potentially crashing the process or enabling arbitrary code execution if an attacker controls the image data. It affects any Perl application that uses the Imager library to read PNG files.

Description

Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8. With a tRNS chunk, read_direct8() adds an alpha channel to the image it creates but still sizes the row buffer from the original channel count. libpng expands the transparency into that extra channel, so png_read_row() fills one channel more than the buffer holds, at one byte per sample, and writes width bytes past the end of the allocation. Palette images go to read_paletted() and 16-bit images to read_direct16(), which sizes its buffer from png_get_rowbytes() and allocates enough for the expanded row. The same reader ships bundled in the Imager distribution. Reading an attacker-supplied PNG through Imager->read() corrupts the heap, which can crash the process.

Impact

The heap corruption can lead to denial‑of‑service by crashing the application, and if the attacker can influence the memory layout, it may allow arbitrary code execution. Confidentiality and integrity are at risk if the attacker can inject malicious code or manipulate image data. Availability is directly impacted through process crashes. Defenders should consider the vulnerability a high‑risk threat to any service that processes PNG images with tRNS chunks.

Remediation

1. Upgrade the Imager library to version 1.004 or later, where the buffer sizing bug is fixed. 2. If an upgrade is not immediately possible, disable processing of tRNS chunks or validate PNGs with a trusted third‑party validator before passing them to Imager. 3. Monitor application logs for segmentation faults or abnormal terminations and apply OS‑level memory protection (e.g., ASLR, stack canaries). 4. Consider switching to an alternative image library that does not exhibit this flaw if the application requires immediate protection.

Risk context

The CVSS v3 score of 9.1 classifies this as critical, indicating a high likelihood of severe impact if exploited. No EPSS data is available, but the lack of a patch in the current release underscores the urgency for defenders to apply the recommended upgrade or mitigation steps promptly.

Affected products

• Imager::File::PNG 1.003
• Perl Imager 1.003
• Imager distribution bundled with Perl
• Perl image-processing scripts
• Web applications using Imager
• Image conversion services
• Perl CGI scripts
• Perl-based CMS image handlers