imageproc has fragile bounds check when sampling from image
Priority LOW 38CWE-190Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
A read of pixels was coded as modifying coordinates to lie within the image bounds. It would calculate a coordinate by adding a constant to an input and taking the minimum of the resulting coordinate and 'dimension - 1'. This would not protect against malicious inputs that could overflow the addition. Following the tricked bounds check, the image could then be sampled at multiple differently calculated coordinates that exceeded the bounds.
Why it matters now
Fix Fixed imageproc (crates.io): 0.24.1, 0.25.1, 0.26.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | imageproc (crates.io) | 0.24.0 to before 0.24.1 | 0.24.1 | Patch available | GHSA-5qv7-j6w5-fr4m |
| — | imageproc (crates.io) | 0.25.0 to before 0.25.1 | 0.25.1 | Patch available | GHSA-5qv7-j6w5-fr4m |
| — | imageproc (crates.io) | 0.26.0 to before 0.26.2 | 0.26.2 | Patch available | GHSA-5qv7-j6w5-fr4m |
- imageproc (crates.io) Vendor— Affected 0.24.0 to before 0.24.1 Fixed in 0.24.1 Patch available GHSA-5qv7-j6w5-fr4m
- imageproc (crates.io) Vendor— Affected 0.25.0 to before 0.25.1 Fixed in 0.25.1 Patch available GHSA-5qv7-j6w5-fr4m
- imageproc (crates.io) Vendor— Affected 0.26.0 to before 0.26.2 Fixed in 0.26.2 Patch available GHSA-5qv7-j6w5-fr4m
Remediation
- Fix · GHSA-5qv7-j6w5-fr4m imageproc (crates.io) Fixed in 0.24.1 Advisory →
- Fix · GHSA-5qv7-j6w5-fr4m imageproc (crates.io) Fixed in 0.25.1 Advisory →
- Fix · GHSA-5qv7-j6w5-fr4m imageproc (crates.io) Fixed in 0.26.2 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-5qv7-j6w5-fr4m
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences