CVE-2026-71202

Received Received - Intake

Raster Rust crate crop function offset underflow vulnerability

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description

The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-10

Generated

2026-08-16

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-15

NVD

CVE-2026-71202

EUVD

EUVD-2026-53199

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer underflow in the raster Rust crate's crop() function. When offset_x or offset_y exceed the source image dimensions, an unchecked subtraction underflows to a negative value. This negative value is cast to usize in Image::blank(), causing a massive memory allocation request that crashes the process.

Detection Guidance

To detect this vulnerability, inspect applications using the raster Rust crate for improper handling of crop() function parameters. Check for crashes when processing user-supplied crop coordinates, especially with offsets exceeding image dimensions. No specific commands are provided in the context.

Impact Analysis

This vulnerability can crash any application using the raster crate when processing a single malformed crop request. The crash occurs due to a denial of service (DoS) condition caused by the process panic from the capacity overflow.

Compliance Impact

This vulnerability primarily causes a denial of service (DoS) by crashing applications processing user-supplied crop coordinates. While it does not directly expose or leak data, a persistent DoS could impact system availability, potentially violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule 164.308(a)(7)). However, no evidence suggests data confidentiality or integrity is compromised.

Mitigation Strategies

Immediately update the raster crate to a patched version that clamps offset_x/offset_y against source dimensions. If updating is not possible, implement input validation in your application to ensure crop parameters are within bounds before calling raster::editor::crop().

Hi! I’m here to help you understand CVE-2026-71202. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70