| Name | CVE-2026-102505 |
| Description | Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every requested channel of each pixel into it. Requesting more than one channel writes past its end. An attacker-supplied image controls the overflowing bytes through its palette. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| libimager-perl (PTS) | bookworm | 1.019+dfsg-1 | vulnerable |
| trixie | 1.027+dfsg-1 | vulnerable | |
| forky | 1.037+dfsg-2 | fixed | |
| sid | 1.040+dfsg-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| libimager-perl | source | experimental | 1.037+dfsg-1 | |||
| libimager-perl | source | (unstable) | 1.037+dfsg-2 |
[trixie] - libimager-perl <no-dsa> (Minor issue)
[bookworm] - libimager-perl <postponed> (Minor issue; overflow only via getsamples(type => 'float') on paletted images)
https://lists.security.metacpan.org/cve-announce/msg/43998313/
https://github.com/tonycoz/imager/security/advisories/GHSA-4rx6-cgv3-fmxp
Fixed by: https://github.com/tonycoz/imager/commit/aae49c6be065aa467e834105c816359394a634db (v1.037)