Imager::File::GIF versions through 1.002 for Perl contain a heap out‑of‑bounds write that is triggered by processing multi‑frame GIF files. The flaw arises from an unchecked call to DGifGetLine in a skip‑image branch that bypasses the buffer‑length validation performed elsewhere in the code. This bug can corrupt arbitrary memory on the heap, potentially leading to a crash, data corruption, or the execution of malicious code if an attacker can influence the bytes written by the call.

The vulnerability affects the TONYC Imager::File::GIF Perl package, specifically the 1.000, 1.001 and 1.002 releases that are used to read GIF images in Perl scripts and applications.

EPSS score is < 1% and the vulnerability is not listed in CISA KEV, and CVSS score is 5.3, so the severity can be quantified as moderate. However, the out‑of‑bounds write is a severe memory corruption flaw; if an untrusted GIF is processed by code with sufficient privileges, the vulnerability can be exploited. Based on the description, it is inferred that the attack vector is any process that loads user‑supplied GIF files, such as a web server, image conversion utility or desktop application, where the attacker can supply a crafted file. The lack of an explicit bounds check makes exploitation straightforward for an attacker who can control the GIF data.