CVE Explorer
CVE-2026-8454
Imager::File::GIF versions through 1.002 for Perl allow a heap out of bounds (OOB) write on crafted multi-frame GIF files.
Imager::File::GIF's i_readgif_multi_low allocates a single per-row buffer GifRow sized for the GIF's global screen width 'SWidth' and reuses it across every image in the file.
The page-match branch validates Image.Width + Image.Left > SWidth before each DGifGetLine write, but the parallel skip-image branch at imgif.c:790-805 calls DGifGetLine(GifFile, GifRow, Width) with n
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","packageName":"Imager-File-GIF","product":"Imager::File::GIF","programFiles":["GIF/imgif.c"],"programRoutines":[{"name":"Imager::File::GIF::i_readgif_multi_low"}],"repo":"https://github.com/tonycoz/imager","vendor":"TONYC","versions":[{"lessThanOrEqual":"1.002","status":"affected","version":"0","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:84d2d7bacac59a6ba0732fbd5f425ea91e8c6f165e4c98e1f8e100ec2f7dfb95 · sha256:664fd8f7b22b4a27… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:84d2d7bacac59a6ba0732fbd5f425ea91e8c6f165e4c98e1f8e100ec2f7dfb95 · sha256:664fd8f7b22b4a27… · /containers/adp/0/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-787","description":"CWE-787 Out-of-bounds Write","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:84d2d7bacac59a6ba0732fbd5f425ea91e8c6f165e4c98e1f8e100ec2f7dfb95 · sha256:664fd8f7b22b4a27… · /containers/cna/problemTypes/0/descriptions/0
Source references
3 source assertions{"url":"http://www.openwall.com/lists/oss-security/2026/05/15/15"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:84d2d7bacac59a6ba0732fbd5f425ea91e8c6f165e4c98e1f8e100ec2f7dfb95 · sha256:664fd8f7b22b4a27… · /containers/adp/1/references/0
{"tags":["patch"],"url":"https://github.com/tonycoz/imager/commit/782e9c06cc75a0f7eed383f39522f51f44598b04.patch"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:84d2d7bacac59a6ba0732fbd5f425ea91e8c6f165e4c98e1f8e100ec2f7dfb95 · sha256:664fd8f7b22b4a27… · /containers/cna/references/1
{"tags":["release-notes"],"url":"https://metacpan.org/release/TONYC/Imager-File-GIF-1.003/source/Changes"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:84d2d7bacac59a6ba0732fbd5f425ea91e8c6f165e4c98e1f8e100ec2f7dfb95 · sha256:664fd8f7b22b4a27… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.