CVE-2026-102505: Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp

Imager, a Perl image-manipulation library, versions before 1.037 miscalculate a heap buffer size (CWE-131) in the i_gsampf_fp routine when float samples are fetched from a paletted image. When code calls getsamples() with type "float" on a paletted image, the library allocates space for only one sample per pixel but writes every requested channel of each pixel into that buffer, so requesting more than one channel writes past the end. An attacker-supplied image can control the overflowing bytes through its palette entries, turning this into a heap overflow with attacker-influenced content that could crash the process or potentially lead to code execution. Any application or service built on Imager before 1.037 that processes untrusted paletted images and fetches multi-channel float samples is affected. No public proof of concept exists and the issue is not in CISA's Known Exploited Vulnerabilities catalog, so exploitation status is none known.