CVE-2026-70378

HighCVSS 7.5

Published: 05/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

imagecli's pipeline operation only asserts, never validating that the ratio is positive. A negative ratio causes the target width to saturate to 0, which is passed to imageproc::seam_carving::shrink_width, a function that panics when given a width below 2, crashing the process.

Risk Assessment

An attacker can cause a denial of service by providing a negative ratio, potentially leading to service unavailability.

Recommendation

Add validation for the ratio (positive value) before use and handle errors gracefully instead of panicking.

Other vulnerabilities in imagecli

CVE-2026-70377High
The imagecli library's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.

Original NVD description (English source)

imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width — a function that panics when given a width below 2, crashing the process.