Is CVE-2026-102505 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102505 being exploited in the wild.

How severe is CVE-2026-102505?

Medium severity, with a CVSS score of 6.3, published 1 October 2026.

Is there a fix for CVE-2026-102505?

Yes: fixed in Imager 1.037. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102505 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102505?

Check whether you run Tony Cook Imager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102505: Imager heap buffer overflow in i_gsampf_fp fetching float samples

CVE-2026-102505 · Severity: medium · CVSS 6.3 · Published 2026-10-01

Imager is a Perl module for image manipulation. A heap buffer overflow in the float sample fetching function can be triggered by processing a specially crafted paletted image when requesting multiple channels, allowing an attacker to overwrite memory with palette-controlled data and potentially execute code or crash the application.

Technologies: Tony Cook Imager. Vendors: Tony Cook.

Quick answers

Is CVE-2026-102505 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102505 being exploited in the wild.
How severe is CVE-2026-102505?: Medium severity, with a CVSS score of 6.3, published 1 October 2026.
Which products and versions are affected?: Tony Cook Imager before 1.037.
Is there a fix for CVE-2026-102505?: Yes: fixed in Imager 1.037. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102505 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102505?: Check whether you run Tony Cook Imager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Imager 1.037

Technical details

The i_gsampf_fp function in Imager allocates a buffer for paletted image samples but fails to account for the number of requested channels, allocating only one sample per pixel instead of one sample per pixel per channel. When multiple channels are fetched, the function writes past the buffer boundary. An attacker supplying a malicious paletted image can control the overflow bytes through the image palette.

Affected products

Tony Cook Imager before 1.037

Timeline

2026-10-01: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.