CVE-2026-93018
Description
A flaw was found in perl-Imager. When handling paletted images with pixel indexes that exceed the defined color map, the library fails to properly validate the palette boundaries. An attacker could exploit this vulnerability by supplying a specially crafted image file to an application that reads or converts the image. Successful exploitation leads to an uninitialized heap memory read, which may result in information disclosure by exposing sensitive data from the application's process memory.
Statement
Red Hat has evaluated this vulnerability as Moderate because exploitation requires an application or user to parse a maliciously crafted image, limiting the security impact to local information disclosure without compromising system integrity or service availability. The perl-Imager component is not distributed in supported Red Hat Enterprise Linux releases and is only maintained within community repositories like Fedora. Risk is further constrained to workloads that explicitly handle paletted image formats and subsequently query pixel values or convert them between color spaces.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory; Read Application Data
When reusing a resource such as memory or a program variable, the original contents may not have been cleared before it is sent to an untrusted party.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Instability
The uninitialized resource may contain values that cause program flow to change in ways that the programmer did not intend, possibly leading to a crash.
Other
Technical Impact: Unexpected State; Varies by Context
The consequences vary depending on the type of resource and how it is used within the product.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
