CVE-2026-93019

Imager (Perl library) versions before 1.036 contain a denial-of-service flaw in the TGA reader. The function tga_palette_read() unpacks a two-byte colour map length into a signed short; values ≥ 32768 become negative, and the subsequent cast to size_t produces a near-SIZE_MAX allocation request. ...