{"id":"CVE-2026-102504","published":"2026-10-01T14:17:20.080","lastModified":"2026-10-01T20:17:21.087","description":"Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol.\n\nNothing range-checks raw_datachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large count requests an excessive allocation. When it fails, Imager's allocator calls exit(3).\n\nPassing an untrusted raw_datachannels value to Imager->read() triggers an uncatchable exit.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-190","CWE-789"],"vendors":[],"products":[],"references":[{"url":"https://github.com/tonycoz/imager/commit/21b0df9eef1dffe1fdcd3706bfea9f1338031679.patch","tags":[]},{"url":"https://github.com/tonycoz/imager/security/advisories/GHSA-g549-r73g-x7x6","tags":[]},{"url":"https://metacpan.org/release/TONYC/Imager-1.037/changes","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/9","tags":[]}],"exploitRefs":[{"url":"https://github.com/tonycoz/imager/commit/21b0df9eef1dffe1fdcd3706bfea9f1338031679.patch","tags":[]},{"url":"https://github.com/tonycoz/imager/security/advisories/GHSA-g549-r73g-x7x6","tags":[]}],"hasPoc":true,"ai":{"summary":"Imager Perl library crashes when reading raw image files with invalid channel count values, causing process termination without exception handling. This allows attackers to trigger uncatchable exits that can be leveraged for DoS attacks.","exploitability":"Exploitation is straightforward when an attacker can upload or process untrusted raw image files through Imager's read() function, requiring no special privileges or complex conditions.","blast_radius":"The impact could be significant in web applications processing user-uploaded images, potentially causing service disruption across multiple concurrent requests or entire application availability.","remediation":"Upgrade to Imager version 1.037 or later to fix the out-of-range raw_datachannels handling.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","image-processing","perl","memory-corruption"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:05:39.833Z"}}