CVE-2026-71202

Summary

The raster Rust crate's crop() function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height. When an offset exceeds the corresponding source dimension, width2 - offset_x (or the height equivalent) underflows to a negative i32, which release builds do not trap; the negative value is then cast to usize inside Image::blank()'s Vec::with_capacity() call, triggering a capacity-overflow panic and crashing the process on a single crafted crop request.

Affected Software

Weaknesses

• CWE-191: CWE-191 Integer Underflow

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

Additional References

• https://github.com/kosinix/raster/issues/30

References

• https://github.com/kosinix/raster/issues/30

• ←Previous
• Next→