CVE-2026-19082

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags. copystringtags computes an ASCII EXIF tag's length as entry-size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry-size to 0...

CVE-2026-19082

The Perl Imager module (versions 0.45_02 before 1.034 ) is vulnerable to a heap over-read in the copy_string_tags() function. The root cause is that a zero-count ASCII EXIF entry sets entry->size to 0, resulting in a length of -1; this causes i_tags_add() to invoke strlen(), which scans past t...