CVE-2026-73638

Name of the Vulnerable Software and Affected Versions Imager for Perl versions 0.45 02 through 1.034

Description An issue exists where the software reads data outside the EXIF block due to unchecked start offsets in the tiff load ifd() function. The function validates data by ensuring the sum of entry->offset and entry->size remains within the EXIF block but fails to verify the start offset itself. In versions up to 1.032, entry->offset is treated as a plain integer, allowing negative values in two's-complement implementations to bypass checks. In versions 1.033 and later, the field is a size t, which can lead to integer wrapping on 32-bit systems. Additionally, the IFD start offset can wrap on systems where unsigned long is 32 bits, including 64-bit Windows. An attacker providing a specially crafted image to the Imager->read() function can cause the process to crash or retrieve EXIF tags containing bytes from outside the intended block.

Recommendations Update Imager for Perl to version 1.035 or later.