CVE-2026-102504

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw datachannels value in i readraw wiol.

Nothing range-checks raw datachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large count requests an excessive allocation. When it fails, Imager's allocator calls exit(3).

Passing an untrusted raw datachannels value to Imager->read() triggers an uncatchable exit.