Skip to content
Fencer Intel
medium —

GHSA-w5p8-4jcx-2j6r json

imageproc: integer overflow in kernel size check leads to out-of-bounds read

published 6mo ago modified 2mo ago also RUSTSEC-2026-0116

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

A bounds verification of a slice storage of a 2-dimensional matrix's coefficients (a kernel) would compare the total size against the product of individual dimensions. This would erroneously cast *after* the multiplication and consequently fail to detect possible violations when overflow occurs.

Afterwards, the individual sizes were trusted to properly constrain coordinates within the matrix to indices valid for the underlying storage. With a crafted `Kernel` object, certain combinations of coordinates could then cause an out-of-bounds access in an `unsafe` function while fulfilling its documented preconditions. The kernel value could be passed to library functions that trusted the preconditions and then performed such reads.

Patch / fix

  • crates.io imageproc 0.23.1, 0.24.1, 0.25.1, 0.26.2

Is GHSA-w5p8-4jcx-2j6r in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io imageproc
<0.23.1
>=0.24.0, <0.24.1
>=0.25.0, <0.25.1
>=0.26.0, <0.26.2
>=0.0.0-0, <0.23.1
0.23.1
0.24.1
0.25.1
0.26.2

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.