EUVD-2026-53198
GHSA-6gxc-w5rp-4g3p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AV:N and PR:N apply to the network-service deployment scenario; A:H reflects unrecoverable process crash; C:N/I:N confirmed as no data exposure or write impact exists.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
imagecli's carve <ratio> pipeline operation (Carve::apply() in src/image_ops.rs) only asserts ratio <= 1.0, never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width - a function that panics when given a width below 2, crashing the process. This shares the same missing-input-validation root cause as the sibling scale finding in the same file but is an independently fixable, distinct code path.
AnalysisAI
Process crash in imagecli's seam-carving pipeline allows denial of service via a negative ratio argument to the carve operation. The Carve::apply() function in src/image_ops.rs validates only that ratio <= 1.0, omitting a positivity check; a negative input saturates to zero through Rust's defined float-to-uint cast, which is forwarded to imageproc::seam_carving::shrink_width - a function that panics on widths below 2, terminating the process. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects that any application exposing imagecli pipeline construction to untrusted input is exploitable with no authentication or interaction.
Technical ContextAI
imagecli is a Rust-based command-line image processing tool authored by theotherphil (CPE: cpe:2.3:a:theotherphil:imagecli:*:*:*:*:*:*:*:*) that supports composable pipeline operations including seam carving for content-aware image resizing. The vulnerability lives in Carve::apply() in src/image_ops.rs and is classified as CWE-1284 (Improper Validation of Specified Quantity in Input): the existing assertion enforces an upper bound (ratio <= 1.0) to prevent upscaling but performs no lower-bound check. In Rust, casting a negative f32/f64 to a u32 is defined behavior that saturates to 0 - unlike C undefined behavior, but semantically incorrect for a dimension calculation. The resulting zero-width value is then passed to imageproc::seam_carving::shrink_width, which contains an explicit runtime panic requiring a minimum input width of 2, producing an unrecoverable process crash. The CVE description notes this shares its root cause with a sibling scale finding in the same file, indicating systemic missing input validation across image_ops.rs pipeline operations.
RemediationAI
The primary fix requires adding an explicit positivity check in Carve::apply() in src/image_ops.rs - asserting or returning an error when ratio <= 0.0 before the float-to-uint width calculation, alongside the existing ratio <= 1.0 upper-bound check. No vendor-released patched version has been confirmed at time of analysis; monitor https://github.com/theotherphil/imagecli/issues/67 and the imagecli GitHub releases page for an official tagged fix. As a compensating control for applications wrapping imagecli, validate and reject any non-positive value for the carve ratio parameter at the application layer before it reaches imagecli - this adds latency negligibly and eliminates the crash path without requiring an imagecli update. If imagecli is used exclusively by trusted operators via CLI, no immediate compensating action is required beyond awareness of the crash trigger.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today