CVE-2026-19082 Information disclosure in Imager
Attackers can read adjacent heap memory by supplying crafted images with zero-count EXIF entries to applications using the Imager Perl library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-19082?
CVE-2026-19082 is a high-severity vulnerability in TONYC Imager, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags.
copy_string_tags() computes an ASCII EXIF tag's length as `entry->size - 1` to strip the trailing NUL. A zero-count ASCII entry sets `entry->size` to 0, and the derived length reaches i_tags_add() as -1, which is interpreted as a request to call strlen(), scanning past the entry to the next NUL and copying those bytes into the tag. JPEG reaches this path via im_decode_exif(), as does the separate Imager::File::WEBP distribution, which is fixed by upgrading Imager.
Any caller of Imager->read() on an attacker-supplied image with such an entry may receive an exif_* tag holding adjacent heap bytes instead of an empty string.
Weakness: CWE-125
Which versions are affected by CVE-2026-19082?
How do I fix CVE-2026-19082?
Upgrade to a fixed version.
Is CVE-2026-19082 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-19082 exists.
Sources
Also known as DEBIAN-CVE-2026-19082, GHSA-hx46-55wp-hv6m, MGASA-2026-0394, UBUNTU-CVE-2026-19082.