CVE-2026-93019
Description
A signed integer conversion flaw was found in the Perl Imager library's TGA file reader. The colourmaplength field in the TGA header is declared as a signed short int. A TGA file with a colour map length of 32768 or greater causes the value to become negative, which sign-extends to a value near SIZE_MAX when cast to size_t for memory allocation. The allocator calls exit(3) on the resulting allocation failure, killing the entire host process in a way that cannot be caught by Perl's eval/die exception handling.
Statement
A signed integer conversion flaw was found in the Perl Imager library's TGA file reader. The colourmaplength field in the TGA header struct is declared as a signed short int. When a TGA file with a colour map length of 32768 (0x8000) or greater is read, the two-byte value becomes negative in the signed field. This negative value sign-extends when cast to size_t for memory allocation, producing a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3), killing the entire host process. This exit is uncatchable — no eval or die block in the calling Perl code can intercept it. Any application that calls Imager->read() on user-supplied image files is vulnerable, as TGA format is auto-detected without requiring an explicit type hint. This issue does not affect any Red Hat product.
Mitigation
Do not process untrusted TGA image files with Imager versions before 1.036. If upgrading is not immediately possible, validate TGA files before passing them to Imager by checking that the colour map length field (header bytes 5-6, little-endian unsigned 16-bit) does not exceed 256, which is the maximum for standard TGA colour-mapped images.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Incorrect sign conversions generally lead to undefined behavior, and therefore crashes.
Integrity
Technical Impact: Modify Memory
If a poor cast lead to a buffer overflow or similar condition, data integrity may be affected.
Integrity,Confidentiality,Availability,Access Control
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism
Improper signed-to-unsigned conversions without proper checking can sometimes trigger buffer overflows which can be used to execute arbitrary code. This is usually outside the scope of a program's implicit security policy.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
