Imagecli
Monthly
Process crash in imagecli's seam-carving pipeline allows denial of service via a negative ratio argument to the `carve` operation. The `Carve::apply()` function in `src/image_ops.rs` validates only that `ratio <= 1.0`, omitting a positivity check; a negative input saturates to zero through Rust's defined float-to-uint cast, which is forwarded to `imageproc::seam_carving::shrink_width` - a function that panics on widths below 2, terminating the process. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects that any application exposing imagecli pipeline construction to untrusted input is exploitable with no authentication or interaction.
Uncontrolled memory allocation in imagecli's `scale` pipeline operation allows remote unauthenticated denial-of-service against any application embedding the library with user-controlled pipeline input. Supplying a large ratio value (e.g., `scale 100000`) causes Scale::apply() in src/image_ops.rs to compute output dimensions that trigger an attempted allocation of hundreds of terabytes, aborting the host process immediately. No active exploitation (CISA KEV) has been identified, but the attack is self-describing from the public GitHub issue and requires no authentication per the CVSS vector (PR:N, AC:L).
Process crash in imagecli's seam-carving pipeline allows denial of service via a negative ratio argument to the `carve` operation. The `Carve::apply()` function in `src/image_ops.rs` validates only that `ratio <= 1.0`, omitting a positivity check; a negative input saturates to zero through Rust's defined float-to-uint cast, which is forwarded to `imageproc::seam_carving::shrink_width` - a function that panics on widths below 2, terminating the process. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects that any application exposing imagecli pipeline construction to untrusted input is exploitable with no authentication or interaction.
Uncontrolled memory allocation in imagecli's `scale` pipeline operation allows remote unauthenticated denial-of-service against any application embedding the library with user-controlled pipeline input. Supplying a large ratio value (e.g., `scale 100000`) causes Scale::apply() in src/image_ops.rs to compute output dimensions that trigger an attempted allocation of hundreds of terabytes, aborting the host process immediately. No active exploitation (CISA KEV) has been identified, but the attack is self-describing from the public GitHub issue and requires no authentication per the CVSS vector (PR:N, AC:L).