CVE-2026-102505 in Imager
Summary
by MITRE • 10/01/2026
Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp.
For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every requested channel of each pixel into it. Requesting more than one channel writes past its end.
An attacker-supplied image controls the overflowing bytes through its palette.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in Imager versions prior to 1.037 represents a critical heap-based buffer overflow within the Perl interface for image processing libraries. This flaw is specifically located in the i_gsampf_fp function, which is responsible for retrieving pixel data from images that utilize paletted color models. The core technical deficiency lies in how memory allocation and subsequent write operations are managed when handling float-type samples. When a request is made to extract sample data of type float from a paletted image, the getsamples routine allocates an output buffer with a size calculated based on one sample per pixel. This calculation assumes that only a single channel of color information will be retrieved for each pixel in the operation.
However, the logic fails to account for scenarios where multiple channels are requested simultaneously. In standard paletted image formats, such as PNG or GIF, pixels reference indices into a palette rather than storing direct RGB values. When an application requests more than one channel per pixel using this specific function, the code proceeds to write data beyond the boundaries of the pre-allocated buffer. Because the allocation size is fixed at one sample per pixel regardless of the number of channels requested, any request for two or three channels results in a write operation that exceeds the allocated memory space. This constitutes a classic heap overflow condition where contiguous memory adjacent to the buffer on the heap is overwritten with untrusted data derived from the image file itself.
The operational impact of this vulnerability is severe due to its potential for remote code execution and denial of service. Since the overflowing bytes are controlled by an attacker-supplied image, specifically through the manipulation of palette entries or metadata that dictates channel retrieval parameters, a malicious actor can craft a specially designed image file containing shellcode or specific memory patterns. When processed by a vulnerable application using Imager before version 1.037, this crafted input allows for arbitrary write operations in heap memory. This capability enables attackers to overwrite function pointers, return addresses, or other critical control data structures, leading to the execution of arbitrary code with the privileges of the compromised process. Additionally, even if exploitation for code execution is not feasible due to modern mitigations like ASLR and DEP, the buffer overflow can cause immediate application crashes by corrupting heap metadata, resulting in a denial of service condition.
From a classification perspective, this vulnerability aligns with CWE-122, which describes a heap-based buffer overflow allowing an attacker to write data outside the intended bounds of allocated memory. It also relates closely to CWE-787 regarding out-of-bounds writes on untrusted input. In terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates initial access and privilege escalation techniques by leveraging improper neutralization before use (CWE-20) during the parsing phase. The attack vector typically involves tricking a user or an automated service into opening a malicious image file, making it particularly dangerous in web applications that process uploaded images without proper validation or sandboxing.
Mitigation strategies must focus on immediate patching and defensive coding practices. The primary remediation is to upgrade Imager to version 1.037 or later, where the developers have corrected the buffer allocation logic to properly account for multi-channel requests in paletted image processing. For environments unable to update immediately, input validation should be implemented at the application layer to restrict supported color depths and channel counts before passing data to the Imager library. Furthermore, enabling heap protection mechanisms such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) can reduce the likelihood of successful exploitation by making memory layout unpredictable and preventing code execution from data pages. Regular security audits focusing on C-level image parsing libraries are essential to identify similar off-by-one or buffer overflow flaws in other multimedia processing components.