Perl Imager CVE-2026-102505

Exploitation requires a host application that uses Imager to call getsamples()/i_gsampf_fp with type 'float' AND to request more than one channel from a paletted (palette-type) image, while processing an attacker-supplied image; the malicious palette supplies the overflowing bytes. Limiting factors: the overflow is NOT reached for single-channel float requests, for non-paletted (direct-color) images, or when the application never reads float samples - so the vulnerable path is usage/configuration-dependent rather than universal. The attacker must be able to deliver an image into that specific code path, and the Imager version must be older than 1.037.

Signals are consistent and point to a genuine but moderate, conditional issue. CVSS 3.1 base is 6.3 (medium) with vector AV:N/AC:L/PR:L/UI:N and partial C/I/A. CISA SSVC reinforces low urgency: Exploitation=none, Automatable=no, Technical Impact=partial. KEV status is NO (not actively exploited) and no public POC/exploit code is referenced - only an advisory, patch commit and changelog. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The one notable tension is the CVSS PR:L (authenticated) rating: the root cause is an attacker-supplied image whose palette controls the overflowing bytes, which in many deployments needs no authentication to submit - but the actual limiting factor is not authentication at all, it is that the host application must call getsamples()/i_gsampf_fp with type 'float' requesting more than one channel from a paletted image. That application-specific code path, not attacker privilege, is what gates exploitation; verify the real auth requirement against the specific deployment rather than treating PR:L as universal. Net: a real memory-safety bug worth patching, but not an emergency - no confirmed exploitation, not automatable, partial impact, and a non-default/usage-dependent trigger.

An application built on Imager accepts a user-uploaded image and, somewhere in its pipeline, reads pixel data as floating-point samples requesting more than one channel. An attacker uploads a crafted paletted image whose palette entries are chosen to control the bytes written past the undersized per-pixel buffer, triggering a heap overflow during getsamples() processing. No public exploit code is identified, and successful memory corruption depends on the application exercising the float multi-channel code path.