CVE-2026-102505
Description
A flaw was found in perl-Imager. When processing floating-point samples from a paletted image, the application allocates an undersized buffer for multi-channel requests. An attacker could provide a specially crafted image to trigger a heap-based buffer overflow with controlled data, potentially leading to arbitrary code execution or a Denial of Service (DoS).
Statement
Red Hat Product Security rates this vulnerability as having an Important severity impact because successful exploitation allows arbitrary memory corruption and potential code execution within the context of the application consuming the image. The flaw triggers when Perl applications parse untrusted paletted image files and request multi-channel floating-point sample extractions, exposing the host process to controlled heap corruption. Red Hat Enterprise Linux does not package or ship perl-Imager in core distributions, restricting the risk to environments where community-provided packages or custom installations utilize this library.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
