CVE-2026-8454

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-8454
Imager::File::GIF versions through 1.002 for Perl allow a heap out of bounds (OOB) write on crafted multi-frame GIF files. Imager::File::GIF's i_readgif_multi_low allocates a single per-row buffer GifRow sized for the GIF's global screen width 'SWidth' and reuses it across every image in the file. The page-match branch validates Image.Width + Image.Left > SWidth before each DGifGetLine write, but the parallel skip-image branch at imgif.c:790-805 calls DGifGetLine(GifFile, GifRow, Width) with no such check.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/tonycoz/imager/commit/782e9c06cc75a0f7eed383f39522f51f44598b04.patch Patch
https://metacpan.org/release/TONYC/Imager-File-GIF-1.003/source/Changes Release Notes
http://www.openwall.com/lists/oss-security/2026/05/15/15 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:tonyc:imager\:\:file\:\:gif:*:*:*:*:*:perl:*:*
History

18 May 2026, 18:12

Type Values Removed Values Added
CPE cpe:2.3:a:tonyc:imager\:\:file\:\:gif:*:*:*:*:*:perl:*:*
First Time Tonyc imager\
Tonyc
References () https://github.com/tonycoz/imager/commit/782e9c06cc75a0f7eed383f39522f51f44598b04.patch - () https://github.com/tonycoz/imager/commit/782e9c06cc75a0f7eed383f39522f51f44598b04.patch - Patch
References () https://metacpan.org/release/TONYC/Imager-File-GIF-1.003/source/Changes - () https://metacpan.org/release/TONYC/Imager-File-GIF-1.003/source/Changes - Release Notes
References () http://www.openwall.com/lists/oss-security/2026/05/15/15 - () http://www.openwall.com/lists/oss-security/2026/05/15/15 - Mailing List, Third Party Advisory

15 May 2026, 22:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/05/15/15 -

15 May 2026, 15:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3

15 May 2026, 12:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-15 12:17

Updated : 2026-05-18 18:12

NVD link : CVE-2026-8454

Mitre link : CVE-2026-8454

CVE.ORG link : CVE-2026-8454

JSON object : View

Products Affected

tonyc

  • imager\
CWE
CWE-787

Out-of-bounds Write