How severe is CVE-2026-93019?

CVE-2026-93019 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability high.

Is CVE-2026-93019 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (48th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-93019?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2026-93019 published?

CVE-2026-93019 was published on 2026-09-18.

CVE-2026-93019

CVE-2026-93019 is a critical-severity vulnerability with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-196.

Key facts

Severity: Critical (CVSS 3.x base score 9.1)
EPSS exploit prediction: 1% (48th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-196
Published: 2026-09-18
Last modified: 2026-09-18

Description

Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read. The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tga_palette_read() casts that value to size_t and asks mymalloc() for a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3). Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.

Frequently asked questions

What is CVE-2026-93019?: Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read. The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tga_palette_read() casts that value to size_t and asks mymalloc() for a size near SIZE_MAX. The allocation fails and Imager's allocator calls exit(3). Reading an attacker-supplied file through Imager->read() triggers an uncatchable exit.
How severe is CVE-2026-93019?: CVE-2026-93019 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability high.
Is CVE-2026-93019 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (48th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-93019?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2026-93019 published?: CVE-2026-93019 was published on 2026-09-18.

References

Other CWE-196 vulnerabilities

CVE-2026-14454 — Critical (CVSS 9.8): Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD…
CVE-2026-58317 — Medium (CVSS 6.3): Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm…
CVE-2026-34155 — Medium (CVSS 5.3): RAUC controls the update process on embedded Linux systems. Prior to version 1.15.2, RAUC bundles using the 'plain'…

Browse all CWE-196 vulnerabilities →