Imager::File::GIF prior to version 1.006 performs a consolidation of GIF images when the gif_consolidate option is enabled, but it fails to validate the palette indices against the bounds of the colour table. The underlying i_readgif_low routine thus reads beyond the allocated heap space and copies the raw bytes into the output pixel buffer, effectively leaking adjacent heap memory and potentially corrupting memory enough to crash the process.

Perl libraries Imager::File::GIF versions before 1.006 and the bundled copy within the Imager distribution are affected. The same flaw also exists in older Imager releases before 1.040, because they ship the vulnerable Imager::File::GIF code internally. Users of any Perl application that relies on these libraries and processes untrusted GIF image files are at risk.

Explicit exploitation requires delivery of a crafted GIF file to the vulnerable application, and the attacker must trigger the gif_consolidate option when decoding the image. No public exploit or exploit code has been disclosed, and the EPSS score is < 1%. The CVSS score of 6.5 indicates moderate severity. The lack of KEV listing means the vulnerability has not yet been widely exploited. The potential impact of leaking sensitive data or causing a denial-of-service makes this a high-value target if the conditions for exploitation are met.