CVE-2026-102505
Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted…
- Risk score
- 41/100
- CVSS
- 6.3 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 1 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every requested channel of each pixel into it. Requesting more than one channel writes pa…
- Affected
- Tonycoz Imager before 1.037
- Fix
- Upgrade Tonycoz Imager to 1.037 or later.
- Exploitation
- No known exploitation
Story map
At a glance
Tonycoz Imager: Yellow, plan it in. Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large count requests an exce…
The flaws
- CVE-2026-102505: Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted… (CVSS 6.3 · EPSS 0%)
- CVE-2026-102504: Integer overflow (CVSS 7.5 · EPSS 0%)
The fix
Upgrade Tonycoz Imager: 1.037 or later on your release line
Who is exposed: Tonycoz Imager before 1.037
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-131 (CWE-131). 9 other warnings in 30 days
Why it is Yellow
- CVSS 6.3 medium
References
Original description
Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every requested channel of each pixel into it. Requesting more than one channel writes past its end. An attacker-supplied image controls the overflowing bytes through its palette.
Last activity 1 Oct 2026. Patch Forecast updates every hour.