CVE-2026-102505: Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp

Q: What conditions are required to trigger the overflow?

The application must call getsamples() on a paletted image with type set to "float" and request more than one channel. The supplied paletted image controls the bytes written beyond the allocated heap buffer.

Q: Who is exposed to this issue?

Applications using affected CPAN/Imager versions are exposed if they process attacker-supplied paletted images through the affected getsamples() float-sample path. Processing images without invoking that combination is not described as vulnerable.

Q: What can be done if upgrading is not immediately possible?

Avoid calling getsamples() with type "float" for paletted images when more than one channel is requested. Restricting or rejecting untrusted paletted images on code paths that use this call can also prevent attacker-controlled overflow data from being processed.

Q: How can I determine whether my application uses the vulnerable path?

Review image-processing code for getsamples() calls that request float samples, then determine whether those calls can receive paletted images and request multiple channels. This combination is the condition described for the heap-buffer overflow.

Published Oct 1, 2026

Updated

Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in igsampffp.

For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every requested channel of each pixel into it. Requesting more than one channel writes past its end.

An attacker-supplied image controls the overflowing bytes through its palette.

Affected Software

1 affected component

CPAN/Imager<1.037

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Imager to a version that resolves this vulnerability.
Fixed in 1.037

Event History

Oct 1, 2026

CVE Published

via MITRE·01:11 PM

Data Sourced

via MITRE·01:11 PM

RemedyDescriptionWeakness

Frequently Asked Questions

What conditions are required to trigger the overflow?

The application must call getsamples() on a paletted image with type set to "float" and request more than one channel. The supplied paletted image controls the bytes written beyond the allocated heap buffer.

Who is exposed to this issue?

Applications using affected CPAN/Imager versions are exposed if they process attacker-supplied paletted images through the affected getsamples() float-sample path. Processing images without invoking that combination is not described as vulnerable.

What can be done if upgrading is not immediately possible?

Avoid calling getsamples() with type "float" for paletted images when more than one channel is requested. Restricting or rejecting untrusted paletted images on code paths that use this call can also prevent attacker-controlled overflow data from being processed.

How can I determine whether my application uses the vulnerable path?

Review image-processing code for getsamples() calls that request float samples, then determine whether those calls can receive paletted images and request multiple channels. This combination is the condition described for the heap-buffer overflow.

CVE-2026-102505: Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required to trigger the overflow?

Who is exposed to this issue?

What can be done if upgrading is not immediately possible?

How can I determine whether my application uses the vulnerable path?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the overflow?

Who is exposed to this issue?

What can be done if upgrading is not immediately possible?

How can I determine whether my application uses the vulnerable path?