CVE-2026-70377

7.5 Élevée

Publiée le 05/08/2026 à 10:16 · Modifiée le 23/10/2026 à 23:10 · Analyse NVD reportée · Source : 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description

imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.

Traduire en français

Produits concernés

theotherphil imagecli

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-789

Références

https://github.com/theotherphil/imagecli/issues/66
https://github.com/theotherphil/imagecli/issues/66

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories