CVE-2026-70378 imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic
Attackers can crash the application by providing a negative carve ratio, bypassing bounds checks and triggering a panic in the image processing pipeline.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-70378?
CVE-2026-70378 is a high-severity denial of service vulnerability in theotherphil imagecli, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width — a function that panics when given a width below 2, crashing the process.
Weakness: CWE-1284
Which versions are affected by CVE-2026-70378?
How do I fix CVE-2026-70378?
No fix has been published for CVE-2026-70378 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-70378 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-70378 exists.
Sources
Also known as GHSA-6gxc-w5rp-4g3p.