CVE-2026-102504 (GCVE-0-2026-102504)

Vulnerability from cvelistv5 – Published: 2026-10-01 13:11 – Updated: 2026-10-01 15:08
VLAI
Title
Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol
Summary
Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large count requests an excessive allocation. When it fails, Imager's allocator calls exit(3). Passing an untrusted raw_datachannels value to Imager->read() triggers an uncatchable exit.
Severity
No CVSS data available.
CWE
  • CWE-789 - Memory Allocation with Excessive Size Value
  • CWE-190 - Integer Overflow or Wraparound
Assigner
References
Impacted products
Vendor Product Version CPE status
Affected: 0 , < 1.037 (custom)
Credits
ahanwate
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-01T15:08:20.353Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/01/9"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "Imager"
          ],
          "packageName": "Imager",
          "packageURL": "pkg:cpan/Imager",
          "programFiles": [
            "raw.c"
          ],
          "programRoutines": [
            {
              "name": "i_readraw_wiol"
            }
          ],
          "repo": "https://github.com/tonycoz/imager",
          "versions": [
            {
              "lessThan": "1.037",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ahanwate"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol.\n\nNothing range-checks raw_datachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large count requests an excessive allocation. When it fails, Imager\u0027s allocator calls exit(3).\n\nPassing an untrusted raw_datachannels value to Imager-\u003eread() triggers an uncatchable exit."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789 Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T13:11:38.558Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/tonycoz/imager/security/advisories/GHSA-g549-r73g-x7x6"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/tonycoz/imager/commit/21b0df9eef1dffe1fdcd3706bfea9f1338031679.patch"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/TONYC/Imager-1.037/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to Imager 1.037 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-30T00:00:00.000Z",
          "value": "Version 1.037 released with fix."
        }
      ],
      "title": "Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-102504",
    "datePublished": "2026-10-01T13:11:38.558Z",
    "dateReserved": "2026-09-29T11:12:58.569Z",
    "dateUpdated": "2026-10-01T15:08:20.353Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://cpan.org/modules",
                "defaultStatus": "unaffected",
                "modules": [
                  "Imager"
                ],
                "packageName": "Imager",
                "packageURL": "pkg:cpan/Imager",
                "programFiles": [
                  "raw.c"
                ],
                "programRoutines": [
                  {
                    "name": "i_readraw_wiol"
                  }
                ],
                "repo": "https://github.com/tonycoz/imager",
                "versions": [
                  {
                    "lessThan": "1.037",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol.\n\nNothing range-checks raw_datachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large count requests an excessive allocation. When it fails, Imager\u0027s allocator calls exit(3).\n\nPassing an untrusted raw_datachannels value to Imager-\u003eread() triggers an uncatchable exit."
          }
        ],
        "id": "CVE-2026-102504",
        "lastModified": "2026-10-01T16:17:34.953",
        "metrics": {},
        "published": "2026-10-01T14:17:20.080",
        "references": [
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://github.com/tonycoz/imager/commit/21b0df9eef1dffe1fdcd3706bfea9f1338031679.patch"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://github.com/tonycoz/imager/security/advisories/GHSA-g549-r73g-x7x6"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://metacpan.org/release/TONYC/Imager-1.037/changes"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.openwall.com/lists/oss-security/2026/10/01/9"
          }
        ],
        "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-190"
              },
              {
                "lang": "en",
                "value": "CWE-789"
              }
            ],
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-10-01T16:29:26+00:00",
      "cve": "CVE-2026-102504",
      "id": "CVE-2026-102504",
      "initial_release_date": "2026-10-01T13:11:38.558000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "perl-Imager: perl-Imager: Denial of Service via out-of-range channel count in raw image reader",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102504.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.