CVE-2026-71202CWE-191

CVE-2026-71202

High · published August 5, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00460 · 38.9th percentile
Weakness
CWE-191 · Integer Underflow (Wrap or Wraparound)
Published
2026-08-05T12:16Z
References (2)
https://github.com/kosinix/raster/issues/30 · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/kosinix/raster/issues/30 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 05 AUG 06:58Z
    raster - Integer Underflow in crop() Offset Handling Causes Capacity-Overflow Panic
    cvelistv5