Skip to content
Fencer Intel
medium —

GHSA-qg8r-f7x3-25f7 json

imageproc: Out-of-bounds read via NaN coordinates in bilinear/bicubic sampling

published 6mo ago modified 2mo ago also RUSTSEC-2026-0117

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

A bounds check was performed in floating points before a cast to the index passed to an unchecked access function. This checked considered `NaN` cases improperly, causing them to succeed the check instead of failing it. The floating point coordinate is under caller control by passing a selected projection matrix.

Carefully controlling the coordinates of an image with no data and one non-zero dimension provides an arbitrary read primitive in the first 32-bits of address space with a Bilinear sampling method.

Using bicubic sampling can result in a read of a few bytes beyond an allocation.

Other out-of-bounds reads may be possible.

Patch / fix

  • crates.io imageproc 0.23.1, 0.24.1, 0.25.1, 0.26.2

Is GHSA-qg8r-f7x3-25f7 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io imageproc
<0.23.1
>=0.24.0, <0.24.1
>=0.25.0, <0.25.1
>=0.26.0, <0.26.2
>=0.0.0-0, <0.23.1
0.23.1
0.24.1
0.25.1
0.26.2

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.