CVE-2026-70378CWE-1284

CVE-2026-70378

High · published August 5, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width — a function that panics when given a width below 2, crashing the process.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00460 · 38.9th percentile
Weakness
CWE-1284 · Improper Validation of Specified Quantity in Input
Published
2026-08-05T12:16Z
References (2)
EPSS history
Timeline
  • 05 AUG 06:58Z
    imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic
    cvelistv5