EUVD-2026-90812Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted paletted image to app
-
DeliveryApplication requests multi-channel float samples
-
ExploitUndersized buffer allocated in i_gsampf_fp
-
ExecutionWrite past heap buffer end via palette bytes
-
ImpactCorrupt adjacent heap, crash or potential code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer size calculation
|
| Exploitation Conditions | Exploitation requires a host application that uses Imager to call getsamples()/i_gsampf_fp with type 'float' AND to request more than one channel from a paletted (palette-type) image, while processing an attacker-supplied image; the malicious palette supplies the overflowing bytes. Limiting factors: the overflow is NOT reached for single-channel float requests, for non-paletted (direct-color) images, or when the application never reads float samples - so the vulnerable path is usage/configuration-dependent rather than universal. The attacker must be able to deliver an image into that specific code path, and the Imager version must be older than 1.037. |
| Impact | Signals are consistent and point to a genuine but moderate, conditional issue. CVSS 3.1 base is 6.3 (medium) with vector AV:N/AC:L/PR:L/UI:N and partial C/I/A. CISA SSVC reinforces low urgency: Exploitation=none, Automatable=no, Technical Impact=partial. KEV status is NO (not actively exploited) and no public POC/exploit code is referenced - only an advisory, patch commit and changelog. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The one notable tension is the CVSS PR:L (authenticated) rating: the root cause is an attacker-supplied image whose palette controls the overflowing bytes, which in many deployments needs no authentication to submit - but the actual limiting factor is not authentication at all, it is that the host application must call getsamples()/i_gsampf_fp with type 'float' requesting more than one channel from a paletted image. That application-specific code path, not attacker privilege, is what gates exploitation; verify the real auth requirement against the specific deployment rather than treating PR:L as universal. Net: a real memory-safety bug worth patching, but not an emergency - no confirmed exploitation, not automatable, partial impact, and a non-default/usage-dependent trigger. |
| Exploit ScenarioDerived | An application built on Imager accepts a user-uploaded image and, somewhere in its pipeline, reads pixel data as floating-point samples requesting more than one channel. An attacker uploads a crafted paletted image whose palette entries are chosen to control the bytes written past the undersized per-pixel buffer, triggering a heap overflow during getsamples() processing. No public exploit code is identified, and successful memory corruption depends on the application exercising the float multi-channel code path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Heap buffer overflow in the Perl Imager module before version 1.037 allows memory corruption inside i_gsampf_fp when a host application asks for float samples across more than one channel of an attacker-supplied paletted image, with the image's own palette controlling the bytes written past the end of the allocation. The vulnerable path is conditional rather than universal: it is only reached when an application calls getsamples() with type 'float' on a palette-type image and requests multiple channels, so real-world exposure depends on how the embedding application uses the library. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC evaluation rates exploitation as 'none' and automatable as 'no'; the vendor CVSS vector indicates low privileges required (PR:L) while our independent assessment treats the vector as unauthenticated with high attack complexity (PR:N/AC:H), so authentication requirements are not consistent across sources.
RemediationAI
Upgrade the Imager Perl module to version 1.037 or later - vendor-released patch: 1.037 - which is the release referenced by the official change log and the fix commit; the exact upstream change is commit aae49c6be065aa467e834105c816359394a634db (patch at https://github.com/tonycoz/imager/commit/aae49c6be065aa467e834105c816359394a634db.patch), which corrects the buffer size calculation in i_gsampf_fp(). If an immediate upgrade is not possible, the most effective compensating control is to avoid the vulnerable call pattern entirely: ensure application code never invokes getsamples() with type 'float' on paletted images while requesting more than one channel - reading a single channel at a time, or requesting integer sample types (8/16-bit) or converting paletted inputs to direct-color before sampling, all stay outside the overflowing path, at the cost of extra sampling calls, possible precision changes, or additional memory for the converted image. Note that the fix commit also removes the dependency on palette-derived data being trusted, so no configuration flag alone fully neutralizes the bug; treat any pipeline that accepts attacker-supplied images into Imager's float sampling code as high priority for upgrade. Additional details are in the vendor advisory at https://github.com/tonycoz/imager/security/advisories/GHSA-4rx6-cgv3-fmxp and the release notes at https://metacpan.org/release/TONYC/Imager-1.037/changes.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Imager is a Perl image-manipulation library whose performance-critical image decoding and sampling routines are implemented in C/XS, exposed to Perl through functions such as getsamples(). The affected routine, i_gsampf_fp() in image.c, retrieves pixel sample values as floating-point data. For paletted (indexed-color) images, the function computed its temporary work buffer as 'mymalloc(sizeof(i_sample_t) * (r-l))' - effectively one sample per pixel in the requested row range - but then wrote one sample for every requested channel of each pixel. This mismatch is a classic CWE-131 (Incorrect Calculation of Buffer Size): the allocation assumes channel count of one, while the write loop iterates over chan_count, producing a heap overflow. The upstream fix (commit aae49c6be065aa467e834105c816359394a634db) changes the allocation to 'sizeof(i_sample_t) * (r-l) * chan_count', restoring the correct size relationship. Because the overflowing values come from the image's palette entries, an attacker crafting the image gains direct influence over the out-of-bounds data, which is why the assessed impact includes low confidentiality, integrity, and availability effects rather than a guaranteed control-flow hijack. The overflow is not triggered for single-channel float requests, for direct-color (non-paletted) images, or by applications that never read float samples.
Know when Imager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Supplying a malicious image needs no privilege (PR:N), but the overflow only triggers when the app requests multi-channel float samples from a paletted image, a specific condition (AC:H); impact is partial heap corruption.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
DescriptionCVE.org
Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp.
For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every requested channel of each pixel into it. Requesting more than one channel writes past its end.
An attacker-supplied image controls the overflowing bytes through its palette.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
Denial of service in the Imager image-processing module for Perl (all versions before 1.033) allows remote attackers to
The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unsp
Perl's Imager image-manipulation module before version 1.037 exits the process when it reads a RAW-format image containi
Heap buffer overflow in Imager for Perl versions through 1.030 allows remote attackers to corrupt memory and potentially
Heap buffer overflow in Imager::File::GIF (Perl image processing library) versions through 1.002 allows local attackers
Exploit-DB