What is the CVSS score of CVE-2026-70377?

CVE-2026-70377 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of imagecli are affected by CVE-2026-70377?

imagecli library contains an uncontrolled memory allocation vulnerability (CVE-2026-70377, CVSS 7.5) allowing remote unauthenticated denial-of-service attacks against any application embedding it.

How to fix or mitigate CVE-2026-70377?

Within 24 hours, identify and inventory all systems and applications embedding the imagecli library to establish baseline exposure. Within 7 days, implement input validation restricting scale operation parameters to reasonable maximums (e.g., 1000x ratio limit), enable rate limiting on image processing endpoints, and communicate the vulnerability and interim controls to relevant development teams. Within 30 days, monitor the imagecli GitHub repository and security advisories for patch availability, establish a deployment plan to apply vendor fixes immediately upon release, and evaluate whether image scaling can be disabled in non-critical services during the interim period.

imagecli CVE-2026-70377

EUVD-2026-53197 HIGH

Memory Allocation with Excessive Size Value (CWE-789)

2026-08-05 TuranSec

GHSA-6mc8-mx43-h2qw

Denial Of Service Imagecli

7.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable via embedding applications requiring no auth; purely an availability impact (process abort) with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 07:55 vuln.today

CVE Published

Aug 05, 2026 - 06:58 cve.org

HIGH 7.5

DescriptionCVE.org

imagecli's scale <ratio> pipeline operation (Scale::apply() in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. A large ratio (e.g. 100000) causes an attempted allocation of hundreds of terabytes, aborting the process. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.

AnalysisAI

Uncontrolled memory allocation in imagecli's scale pipeline operation allows remote unauthenticated denial-of-service against any application embedding the library with user-controlled pipeline input. Supplying a large ratio value (e.g., scale 100000) causes Scale::apply() in src/image_ops.rs to compute output dimensions that trigger an attempted allocation of hundreds of terabytes, aborting the host process immediately. No active exploitation (CISA KEV) has been identified, but the attack is self-describing from the public GitHub issue and requires no authentication per the CVSS vector (PR:N, AC:L).

Technical ContextAI

imagecli is a Rust-based image processing CLI library authored by theotherphil (CPE: cpe:2.3:a:theotherphil:imagecli:*:*:*:*:*:*:*:*). The vulnerability is in Scale::apply() in src/image_ops.rs, where the output image dimensions are computed as (dimension as f32 * ratio) as u32. The ratio operand is parsed from the user-supplied pipeline string using nom::number::complete::float, a lexical floating-point parser that applies no range constraint. Because the resulting u32 dimension is passed directly to the image buffer allocator without an upper-bound check, an attacker-supplied ratio of 100000 or greater causes the runtime to attempt a terabyte-scale heap allocation, which fails catastrophically and aborts the process. CWE-789 (Uncontrolled Memory Allocation) precisely classifies this root cause: the program sizes an allocation using an unvalidated, attacker-controlled value.

RemediationAI

No vendor-released patch has been identified at time of analysis - the issue is open in the upstream repository at https://github.com/theotherphil/imagecli/issues/66 with no confirmed fix commit or tagged release. As a primary compensating control, applications embedding imagecli should enforce an explicit upper bound on the scale ratio before constructing or passing pipeline strings to imagecli's processor - for example, clamping the ratio to a safe maximum (e.g., ratio ≤ 100.0) at the application layer; this trades some functionality for process safety and is non-breaking for legitimate use cases. Alternatively, if the scale pipeline operation is not required for the application's use case, block or strip scale commands from user-supplied pipeline strings entirely. For deployments where only trusted operators supply pipeline strings, restrict OS-level access to the embedding application. Monitor https://github.com/theotherphil/imagecli for a patch and apply it promptly upon release.