CVE-2026-70378

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width — a function that panics when given a width below 2, crashing the process.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1284

Affected software

VendorProductVersions
theotherphilimagecli<= 0.2.1

References

Timeline

Published
Aug 5, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-703796.5When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an unauthenticated RTSP/RTPCVE-2026-70383.3A weakness has been identified in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.ts of the component CCVE-2026-703805.3A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauthCVE-2026-703815.3An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could beCVE-2026-703824.1Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker whCVE-2026-703838.4Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estonian Information System Authority (RIA) CVE-2026-703868.5Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePluCVE-2026-703878.4Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes CVE-2026-703888.3SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cauCVE-2026-70397.8A security vulnerability has been detected in tufantunc ssh-mcp up to 1.5.0. The affected element is the function shell.write of the file srCVE-2026-703952.1Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship CVE-2026-703965.4Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other reposi