CVE-2026-71202
Received Received - Intake

Raster Rust crate crop function offset underflow vulnerability

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
The raster Rust crate's crop() function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height. When an offset exceeds the corresponding source dimension, `width2 - offset_x` (or the height equivalent) underflows to a negative i32, which release builds do not trap; the negative value is then cast to usize inside Image::blank()'s Vec::with_capacity() call, triggering a capacity-overflow panic and crashing the process on a single crafted crop request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71202
EUVD
EUVD-2026-53199

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an integer underflow in the raster Rust crate's crop() function. When offset_x or offset_y exceed the source image dimensions, an unchecked subtraction underflows to a negative value. This negative value is cast to usize in Image::blank(), causing a massive memory allocation request that crashes the process.

Detection Guidance

To detect this vulnerability, inspect applications using the raster Rust crate for improper handling of crop() function parameters. Check for crashes when processing user-supplied crop coordinates, especially with offsets exceeding image dimensions. No specific commands are provided in the context.

Impact Analysis

This vulnerability can crash any application using the raster crate when processing a single malformed crop request. The crash occurs due to a denial of service (DoS) condition caused by the process panic from the capacity overflow.

Compliance Impact

This vulnerability primarily causes a denial of service (DoS) by crashing applications processing user-supplied crop coordinates. While it does not directly expose or leak data, a persistent DoS could impact system availability, potentially violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule 164.308(a)(7)). However, no evidence suggests data confidentiality or integrity is compromised.

Mitigation Strategies

Immediately update the raster crate to a patched version that clamps offset_x/offset_y against source dimensions. If updating is not possible, implement input validation in your application to ensure crop parameters are within bounds before calling raster::editor::crop().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71202. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart