# CVE-2026-102505: Imager heap buffer overflow in i_gsampf_fp fetching float samples

Source: https://junglewise.ai/threats/cve-2026-102505-imager-versions-before-1-037-for-perl-overflow-a-heap-buffer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-102505 · Severity: medium · CVSS 6.3 · Published 2026-10-01

Imager is a Perl module for image manipulation. A heap buffer overflow in the float sample fetching function can be triggered by processing a specially crafted paletted image when requesting multiple channels, allowing an attacker to overwrite memory with palette-controlled data and potentially execute code or crash the application.

Technologies: [Tony Cook Imager](https://junglewise.ai/threats/technologies/imager). Vendors: [Tony Cook](https://junglewise.ai/threats/vendors/tony-cook).

## Quick answers

**Is CVE-2026-102505 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102505 being exploited in the wild.

**How severe is CVE-2026-102505?** Medium severity, with a CVSS score of 6.3, published 1 October 2026.

**Which products and versions are affected?** Tony Cook Imager before 1.037.

**Is there a fix for CVE-2026-102505?** Yes: fixed in Imager 1.037. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102505 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102505?** Check whether you run Tony Cook Imager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Imager 1.037

## Technical details

The i_gsampf_fp function in Imager allocates a buffer for paletted image samples but fails to account for the number of requested channels, allocating only one sample per pixel instead of one sample per pixel per channel. When multiple channels are fetched, the function writes past the buffer boundary. An attacker supplying a malicious paletted image can control the overflow bytes through the image palette.

## Affected products

- Tony Cook Imager before 1.037

## Timeline

- 2026-10-01: disclosed

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/tonycoz/imager/commit/aae49c6be065aa467e834105c816359394a634db.patch](https://github.com/tonycoz/imager/commit/aae49c6be065aa467e834105c816359394a634db.patch)

## Related threats

- [Imager::File::GIF out-of-bounds read in GIF consolidation](https://junglewise.ai/threats/cve-2026-112202-imager-file-gif-versions-before-1-006-for-perl-allow-out-of)
- [TONYC Imager unsigned to signed conversion error in EXIF parsing](https://junglewise.ai/threats/cve-2026-14454-tonyc-imager-unsigned-to-signed-conversion-error-in-exif-parsing)
- [Imager Perl library heap out-of-bounds write in GIF parser](https://junglewise.ai/threats/cve-2026-8669-imager-perl-library-heap-out-of-bounds-write-in-gif-parser)