Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-70378

imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic

Description

imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width — a function that panics when given a width below 2, crashing the process.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

theotherphil imagecli

Default version status: unknown

  • 0 to ≤ 0.2.1affected

References