CVE-2026-102505Medium· 6.3▾ SunlitImager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
— → 6.3
none → medium
0.2%
Last analysed / modified upstream
0.2% → 0.2%
Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp.
For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every requested channel of each pixel into it. Requesting more than one channel writes past its end.
An attacker-supplied image controls the overflowing bytes through its palette.
imager < 1.037Upgrade past the affected range:
imager 1.037Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102504High· 7.5Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels
CVE-2026-97631Critical· 9.5Pre-boot RCE in EDK II PXE driver
CVE-2026-80832Medium· 4.4kernel: crypto: qce - fix CCM AAD buffer underallocation (CVE-2026-80832)
CVE-2026-112008Medium· 6.1libmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordr
CVE-2026-63939Critical· 9.3KVM: SEV: Compute the correct max length of the in-GHCB scratch area
CVE-2025-38608High· 8.6In the Linux kernel, the following vulnerability has been resolved: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls When sending plaintext data, we initially calculated the corresponding ciphertext length