Raster
Monthly
Integer underflow in the raster Rust crate's crop() function enables remote process crash via a single crafted request. When offset_x or offset_y exceeds the source image dimension, the signed subtraction wraps to a large negative i32 in release builds; that value is then cast to usize and passed to Vec::with_capacity(), triggering an unrecoverable capacity-overflow panic that kills the host process. No active exploitation is confirmed (not in CISA KEV) and no public POC is listed, but the AV:N/AC:L/PR:N/UI:N CVSS vector indicates zero-friction denial-of-service for any application that exposes the crop() call to untrusted input.
Integer underflow in the raster Rust crate's crop() function enables remote process crash via a single crafted request. When offset_x or offset_y exceeds the source image dimension, the signed subtraction wraps to a large negative i32 in release builds; that value is then cast to usize and passed to Vec::with_capacity(), triggering an unrecoverable capacity-overflow panic that kills the host process. No active exploitation is confirmed (not in CISA KEV) and no public POC is listed, but the AV:N/AC:L/PR:N/UI:N CVSS vector indicates zero-friction denial-of-service for any application that exposes the crop() call to untrusted input.