CVE-2026-13705

Name of the Vulnerable Software and Affected Versions Imager versions prior to 1.032

Description An issue exists in the bundled Imager::File::SGI reader where a heap out-of-bounds read occurs during the processing of a 16-bit RLE (Run-Length Encoding) literal run within the read rgb 16 rle() function. The function fails to correctly validate the pixel count against the remaining data length, as it does not account for the fact that each 16-bit sample requires two bytes. Consequently, a specially crafted SGI image processed via Imager->read can trigger an over-read that may crash the process.

Recommendations Update to version 1.032 or later.