CVE-2026-19082

Name of the Vulnerable Software and Affected Versions Imager versions 0.45 02 through 1.033

Description An over-read occurs in the copy string tags() function when processing zero-count ASCII EXIF entries. The function calculates the tag length as entry->size - 1; if entry->size is 0, the resulting length of -1 is passed to i tags add(), which triggers a strlen() call. This causes the system to scan past the entry until the next NUL character is found, potentially exposing adjacent heap bytes. This path is reachable via im decode exif() when using JPEG images or the Imager::File::WEBP distribution. An attacker can exploit this by providing a specially crafted image to Imager->read(), causing the exif * tag to contain sensitive heap data instead of an empty string.

Recommendations Update Imager to version 1.034 or later.