CVE-2026-102504
Tonycoz Imager: integer overflow
- Risk score
- 56/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 1 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large count requests an exce…
- Affected
- Tonycoz Imager before 1.037
- Fix
- Upgrade Tonycoz Imager to 1.037 or later.
- Exploitation
- No known exploitation
Story map
At a glance
Tonycoz Imager: Yellow, plan it in. Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large count requests an exce…
The flaws
- CVE-2026-102504: Integer overflow (CVSS 7.5 · EPSS 0%)
- CVE-2026-102505: Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted… (CVSS 6.3 · EPSS 0%)
The fix
Upgrade Tonycoz Imager: 1.037 or later on your release line
Who is exposed: Tonycoz Imager before 1.037
Where it stands
- No known exploitation
Connects to
- Same weakness: Integer overflow (CWE-190). 125 other warnings in 30 days
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large count requests an excessive allocation. When it fails, Imager's allocator calls exit(3). Passing an untrusted raw_datachannels value to Imager->read() triggers an uncatchable exit.
Last activity 1 Oct 2026. Patch Forecast updates every hour.