CVE-2026-102505
Received Received - Intake

Heap Buffer Overflow in Imager Perl Library

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: CPANSec

Description
Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every requested channel of each pixel into it. Requesting more than one channel writes past its end. An attacker-supplied image controls the overflowing bytes through its palette.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-102505
EUVD
EUVD-2026-90812

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-131 The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap buffer overflow in the Imager Perl library versions before 1.037. It occurs when processing paletted images with the getsamples() function requesting more than one channel. The function incorrectly allocates a buffer based only on pixel count, not accounting for multiple channels, causing writes to exceed allocated memory. Attackers can exploit this by supplying malicious images to control the overflowed data.

Detection Guidance

To detect this vulnerability, check the version of the Perl Imager package installed on your system. If it is version 1.036 or earlier, the system is vulnerable. Use commands like 'cpan Imager' or 'perl -MImager -e "print $Imager::VERSION"' to verify the installed version.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary code or crash applications using the Imager library. If you process untrusted images with affected versions, attackers might gain control over your system. The impact includes potential data breaches, system compromise, or denial of service.

Mitigation Strategies

Immediately upgrade the Imager package to version 1.037 or later. As a temporary workaround, convert paletted images to direct color images using methods like 'to_rgb8'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102505. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart