CVE-2026-73639: Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8

As cited

Copy frozen at 2026-09-18 01:36 UTC (site build).

vulnerabilities

CVE-2026-73639: Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8

CVE-2026-73639 affects Imager::File::PNG for Perl versions 1.003 through 1.003, allowing a buffer overflow when processing PNG files with transparency (tRNS) chunks during 8-bit direct color reads. An attacker can trigger the vulnerability by supplying a malicious PNG file to an application using the affected library.

Why it matters: Perl developers using Imager::File::PNG to process PNG images face potential remote code execution if they accept untrusted image files; upgrade to version 1.004 or later.

Source published

2026-09-17 22:08 UTC

First seen by Cybersecurity Tracker

2026-09-18 00:19 UTC