Imager versions prior to 1.037 in the Perl image processing library allow a heap buffer overflow when fetching float samples from a paletted image. When a caller requests more than one channel, the code writes past the allocated buffer, allowing an attacker to overwrite memory beyond the intended sample space. This memory corruption can lead to arbitrary code execution, information disclosure, or denial of service.

The vulnerability affects the Perl Imager library for any installation using a version older than 1.037. Systems that load user‑supplied images via Imager in Perl scripts—such as web applications or image‑manipulation utilities—are potentially impacted. No specific products beyond the general Imager module are listed.

With a CVSS score of 6.3, the overflow is classic and straightforward to exploit if an attacker can supply a crafted image. The EPSS score is not available, indicating no measurable data on exploit prevalence, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need the ability to provide a malicious image to a Perl process that uses Imager; this could occur in local or remote contexts, for example, a web application rendering user‑submissions. Based on the description, the likely attack vector involves an attacker supplying a crafted image that triggers the overflow during the getsamples() call and may lead to arbitrary code execution or other severe impacts.