CVE-2026-102505

Katalog CVE

CVSS 6.3 · Medium EPSS 0,25%

Kerentanan Incorrect Calculation of Buffer Size pada tonycoz imager. Skor CVSS 3.1 6.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every requested channel of each pixel into it. Requesting more than one channel writes past its end. An attacker-supplied image controls the overflowing bytes through its palette.

Rincian

Terbit di NVD

1 Oktober 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-131: Incorrect Calculation of Buffer Size

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 14,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tonycoz/imager/security/advisories/GHSA-4rx6-cgv3-fmxp mitigasi · advisory vendor
• https://github.com/tonycoz/imager/commit/aae49c6be065aa467e834105c816359394a634db.patch patch
• http://www.openwall.com/lists/oss-security/2026/10/01/10 mailing list · advisory pihak ketiga
• https://metacpan.org/release/TONYC/Imager-1.037/changes release notes