CVE-2026-70378
Received Received - Intake

Imagecli Carve Operation Negative Ratio Crash

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
imagecli's `carve <ratio>` pipeline operation (Carve::apply() in src/image_ops.rs) only asserts `ratio <= 1.0`, never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width — a function that panics when given a width below 2, crashing the process. This shares the same missing-input-validation root cause as the sibling `scale` finding in the same file but is an independently fixable, distinct code path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70378
EUVD
EUVD-2026-53198

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability is in imagecli's carve operation where the ratio parameter is not validated to ensure it is positive. A negative ratio causes the target width to become zero, leading to a panic in the seam_carving function when it receives a width below 2, crashing the process.

Detection Guidance

This vulnerability is specific to the imagecli tool's carve operation and cannot be detected via general network or system commands. It requires testing the carve function with a negative ratio input to observe a crash due to a panic in imageproc::seam_carving::shrink_width.

Impact Analysis

This vulnerability can cause denial-of-service by crashing the application when processing images with a negative carve ratio. It may lead to service unavailability or unexpected termination of image processing tasks.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It causes a Denial of Service (DoS) by crashing the process when invalid input is provided, which is a reliability issue rather than a data protection or privacy concern.

Mitigation Strategies

Update imagecli to the latest version where the carve operation validates that the ratio is positive. If updating is not possible, avoid using the carve operation with negative or zero ratios until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70378. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart