CVE-2026-102504

7.5 HIGHpublic exploit available

Published 2026-10-01 · Updated 2026-10-01

AI risk analysis

Summary: Imager Perl library crashes when reading raw image files with invalid channel count values, causing process termination without exception handling. This allows attackers to trigger uncatchable exits that can be leveraged for DoS attacks.
Exploitability: Exploitation is straightforward when an attacker can upload or process untrusted raw image files through Imager's read() function, requiring no special privileges or complex conditions.
Blast radius: The impact could be significant in web applications processing user-uploaded images, potentially causing service disruption across multiple concurrent requests or entire application availability.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Imager version 1.037 or later to fix the out-of-range raw_datachannels handling.

dosimage-processingperlmemory-corruption

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large count requests an excessive allocation. When it fails, Imager's allocator calls exit(3). Passing an untrusted raw_datachannels value to Imager->read() triggers an uncatchable exit.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-190, CWE-789

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.