EUVD-2026-90811Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted raw-image read request
-
ExploitSupply out-of-range raw_datachannels value
-
ExecutionTrigger oversized/overflowed buffer allocation
-
ImpactAllocation fails and allocator calls exit(3), process terminates
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory allocation limits
|
| Exploitation Conditions | Requires the target application to (1) use Imager to read RAW-format image data via Imager->read() and (2) allow the raw_datachannels parameter to be set from untrusted input; an out-of-range value (negative, 0, or >16) is what triggers the oversized allocation and subsequent exit(). Limiting factors: this is not reachable against a default configuration that hard-codes raw_datachannels or does not expose RAW reading - the attacker must control that specific parameter. Affected versions are Imager before 1.037; impact is confined to denial of service (process termination), with no confidentiality or integrity consequence. |
| Impact | Signals point to a real but narrow availability-only defect rather than a top-tier priority. The CVSS 7.5 (HIGH) score is driven entirely by A:H with C:N/I:N - this is a denial-of-service via uncatchable process exit, NOT a memory-corruption/code-execution bug, so the raw 7.5 overstates practical severity. SSVC reinforces this: Exploitation=none (no observed activity), Automatable=yes (the trigger is a single parameter value), Technical Impact=partial. KEV status is NO (not CISA-listed) and no public exploit code is referenced. EPSS is NOT provided in the input, so probabilistic exploitation likelihood cannot be quantified - treat its absence as a data gap, not a low score. The biggest real-world mitigant is a prerequisite the CVSS vector hides: although the vector reads AV:N/AC:L/PR:N/UI:N, exploitation requires that the host application both reads RAW-format images AND exposes the raw_datachannels parameter to attacker-controlled input - this is not a default or common integration pattern. Net: a legitimately fixable DoS, but closer to 'high CVSS, moderate real risk' and gated by application design rather than broadly exploitable against defaults. |
| Exploit ScenarioDerived | A web service uses Imager (Perl) to decode user-supplied RAW images and lets the untrusted request control the raw_datachannels parameter. An attacker submits a request with a negative or very large raw_datachannels value, causing Imager to attempt an excessive line-buffer allocation that fails; Imager's allocator then calls exit(3), uncatchably terminating the worker process and denying service. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Perl's Imager image-manipulation module before version 1.037 exits the process when it reads a RAW-format image containing an out-of-range raw_datachannels value, because the line-buffer size is computed as image width multiplied by the channel count with no range or overflow validation and the module's allocator calls exit(3) when the resulting allocation fails. The flaw is reachable only where an application uses Imager->read() on RAW data and permits the raw_datachannels parameter to come from untrusted input; a hard-coded or non-exposed value makes it unreachable. Impact is limited to denial of service - process termination with no confidentiality or integrity effect - and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; CISA's SSVC assessment rates exploitation as none, with the defect automatable but technically partial.
RemediationAI
Vendor-released patch: Imager 1.037, which validates raw_datachannels to the documented range of 1 to 16 and adds an overflow check (im_mult_overflow2) on the line-buffer size calculation; upgrade via CPAN (cpan TONYC/Imager-1.037 or your distribution's perl-Imager package) and confirm the installed version reports 1.037 or later. The upstream fix is visible in commit 21b0df9eef1dffe1fdcd3706bfea9f1338031679.patch and the advisory GHSA-g549-r73g-x7x6. If immediate upgrading is not possible, the only reliable compensating control is to stop untrusted input from reaching the parameter: hard-code raw_datachannels in application code, reject any request or upload that specifies a RAW type with a caller-supplied channel count, and whitelist the value to 1-16 before the Imager->read() call - note that because the failure path is an uncatchable exit(3), wrapping the call in eval {} will not protect the process and shelling out to an external converter does not remove the risk either. Removing or gating RAW-format upload handling entirely eliminates reachability at the cost of losing RAW import functionality, and running the parsing work in a separate, disposable worker process or container limits the blast radius of an unexpected exit to that process rather than the whole application.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-102504 is an instance of CWE-789, Memory Allocation with Excessive Size Value, in the RAW decoder of the Perl Imager library. The vulnerable routine, i_readraw_wiol() in raw.c, derives its input line-buffer length directly from the caller-supplied raw_datachannels parameter multiplied by the image width, but performs neither a bounds check on the parameter nor an arithmetic overflow check on the multiplication. A negative or very large channel count therefore either underflows the size calculation or requests an enormous allocation; when that allocation fails, Imager's error path invokes exit(3), which bypasses Perl's eval-based exception handling and terminates the entire interpreter rather than returning a catchable error. The upstream fix introduces two guards - the value is restricted to the documented range of 1 to 16, and the buffer-size computation is routed through im_mult_overflow2() to detect integer overflow - both of which return a normal Perl-level error instead of exiting. The module is a general-purpose imaging toolkit used by Perl web applications and batch processors, so exposure depends entirely on whether the hosting application forwards user-controlled data into the raw_datachannels parameter of an Imager->read() call with type => "raw".
Know when Imager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remotely reachable where the app exposes raw_datachannels; no auth or interaction inherent to the library call; single untrusted value causes uncatchable exit, so availability-only A:H with C/I:N.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
2DescriptionCVE.org
Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol.
Nothing range-checks raw_datachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large count requests an excessive allocation. When it fails, Imager's allocator calls exit(3).
Passing an untrusted raw_datachannels value to Imager->read() triggers an uncatchable exit.
Technical POC Analysis
CWE-789 (Memory Allocation with Excessive Size Value), with the advisory also tagging CWE-190 (Integer Overflow/Wraparound).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Perl's Imager image-manipulation module (versions before 1.037) can be forced to abort the calling process when it reads a crafted RAW-format image, handing an attacker a cheap and repeatable denial-of-service lever against any Perl-based service that accepts images from untrusted users. The defect produces process termination only - no data disclosure, no integrity or tampering effect - and it is reachable solely in applications that call Imager->read() on RAW data while allowing the raw_datachannels parameter to be supplied by external input, meaning many deployments are structurally immune. Leadership should care because media processing, upload validation, and document conversion pipelines built on Perl can be knocked offline on demand, degrading customer-facing availability while remaining a narrow, well-bounded issue rather than a breach risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
Denial of service in the Imager image-processing module for Perl (all versions before 1.033) allows remote attackers to
The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unsp
Heap buffer overflow in Imager for Perl versions through 1.030 allows remote attackers to corrupt memory and potentially
Heap buffer overflow in the Perl Imager module before version 1.037 allows memory corruption inside i_gsampf_fp when a h
Heap buffer overflow in Imager::File::GIF (Perl image processing library) versions through 1.002 allows local attackers
Exploit-DB