Perl Imager before 1.037 has crash and heap-overflow CVEs
Stig Palmquist disclosed two Perl Imager flaws before 1.037: a raw-image crash and a paletted-image heap overflow, with no exploitation reported.
On 1 October 2026, Stig Palmquist posted two oss-security notices about the Perl Imager library in versions before 1.037. CVE-2026-102504 causes the process to exit inside i_readraw_wiol when a raw image has an out-of-range raw_datachannels value, and is described as a crash or denial of service rather than a reported exploitation campaign. CVE-2026-102505 overflows a heap buffer in i_gsampf_fp while fetching float samples from a paletted image. That notice points to the Imager distribution on MetaCPAN and the tonycoz/imager GitHub repository, and it does not describe a public proof of concept or say the flaw is being exploited. The two reports agree on the affected versions and the reporter and do not conflict.
- CVE-2026-102504 affects Perl Imager versions before 1.037.
- An out-of-range raw_datachannels value causes the process to exit inside i_readraw_wiol while reading a raw image.
- CVE-2026-102504 is described as a crash or denial of service, not a reported exploitation campaign.
- CVE-2026-102505 affects Perl Imager versions before 1.037.
- i_gsampf_fp can overflow a heap buffer while fetching float samples from a paletted image.
- Both issues were posted to oss-security by Stig Palmquist on 2026-10-01.
- The CVE-2026-102505 notice cites the Imager distribution on MetaCPAN and the tonycoz/imager GitHub repository, and does not describe a public proof of concept or say the flaw is being exploited.
Coverage timelineoldest first · each row is one article
- · 15d agoCVE-2026-102504: Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol
oss-security· 28
Perl Imager before 1.037 exits when a raw image has an out-of-range raw_datachannels value.
- · 15d agoCVE-2026-102505: Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp
Perl Imager before 1.037 has heap buffer overflow CVE-2026-102505 when fetching float samples from paletted images.
Vulnerabilities in this storyAll →
- CVE-2026-1025047.5—Denial of service in Perl Imager before 1.037 via out-of-range raw image channel countpublished · Imager project (CPAN / Perl) Imager+1 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
CVE-2026-102504+1 related CVE | Denial of service in Perl Imager before 1.037 via out-of-range raw image channel count Imager, a Perl image-processing library, fails to validate the raw_datachannels field when reading a 'raw' format image in i_readraw_wiol, in all versions before 1.037. The value is used to size a line buffer as image width times channel count with no range or overflow check, so a negative or very large count requests an excessive allocation; when that allocation fails, Imager's internal allocator calls exit(3), terminating the entire Perl process in a way the application cannot catch or trap. An attacker triggers the flaw by getting an application that feeds untrusted files to Imager->read() to process a crafted raw image with a malicious raw_datachannels value, yielding a straightforward denial of service against services such as web apps that accept and process image uploads. Any deployment using Imager before 1.037 that reads raw-format images from untrusted sources is affected. The vulnerability has no CVSS score yet, no public proof of concept, is not in the CISA KEV catalog, and there is no evidence of exploitation in the wild. |