CVE-2026-70378

Received Received - Intake

Imagecli Carve Operation Negative Ratio Crash

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: TuranSec

Description

imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width — a function that panics when given a width below 2, crashing the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-10

Generated

2026-08-25

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-24

NVD

CVE-2026-70378

EUVD

EUVD-2026-53198

Affected Vendors & Products

Vendor	Product	Version / Range
theotherphil	imagecli	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1284	The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

Executive Summary

The vulnerability is in imagecli's carve operation where the ratio parameter is not validated to ensure it is positive. A negative ratio causes the target width to become zero, leading to a panic in the seam_carving function when it receives a width below 2, crashing the process.

Detection Guidance

This vulnerability is specific to the imagecli tool's carve operation and cannot be detected via general network or system commands. It requires testing the carve function with a negative ratio input to observe a crash due to a panic in imageproc::seam_carving::shrink_width.

Impact Analysis

This vulnerability can cause denial-of-service by crashing the application when processing images with a negative carve ratio. It may lead to service unavailability or unexpected termination of image processing tasks.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It causes a Denial of Service (DoS) by crashing the process when invalid input is provided, which is a reliability issue rather than a data protection or privacy concern.

Mitigation Strategies

Update imagecli to the latest version where the carve operation validates that the ratio is positive. If updating is not possible, avoid using the carve operation with negative or zero ratios until a patch is applied.

Hi! I’m here to help you understand CVE-2026-70378. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70