GHSA-5qv7-j6w5-fr4m
imageproc has fragile bounds check when sampling from image
GHSA-5qv7-j6w5-fr4m is a medium vulnerability (CVSS 6.9) in imageproc, published May 1, 2026. No source lists public exploit code. Fixed in imageproc 0.24.1.
- Severity
- 6.9 MediumCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.24.1imageproc +5 more
Description
A read of pixels was coded as modifying coordinates to lie within the image bounds. It would calculate a coordinate by adding a constant to an input and taking the minimum of the resulting coordinate and 'dimension - 1'. This would not protect against malicious inputs that could overflow the addition. Following the tricked bounds check, the image could then be sampled at multiple differently calculated coordinates that exceeded the bounds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Affected packages
| Package | Affected | Fixed |
|---|---|---|
imageproccrates.io | 0.24.0 to 0.24.0 | 0.24.1 |
imageproccrates.io | 0.25.0 to 0.25.0 | 0.25.1 |
imageproccrates.io | 0.26.0 up to 0.26.2 | 0.26.2 |
imageproccrates.io | 0.24.0 up to 0.24.1 | 0.24.1 |
imageproccrates.io | 0.25.0 up to 0.25.1 | 0.25.1 |
imageproccrates.io | 0.24.0 up to 0.24.1, 0.25.0 up to 0.25.1, 0.26.0 up to 0.26.2 | 0.24.10.25.10.26.2 |
What each source reports
GitHub Advisories Score used
imageproc has fragile bounds check when sampling from image
A read of pixels was coded as modifying coordinates to lie within the image bounds. It would calculate a coordinate by adding a constant to an input and taking the minimum of the resulting coordinate and 'dimension - 1'. This would not protect against malicious inputs that could overflow the addition. Following the tricked bounds check, the image could then be sampled at multiple differently calculated coordinates that exceeded the bounds.
- Record
GHSA-5qv7-j6w5-fr4m- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
imageproc has fragile bounds check when sampling from image
A read of pixels was coded as modifying coordinates to lie within the image bounds. It would calculate a coordinate by adding a constant to an input and taking the minimum of the resulting coordinate and 'dimension - 1'. This would not protect against malicious inputs that could overflow the addition. Following the tricked bounds check, the image could then be sampled at multiple differently calculated coordinates that exceeded the bounds.
- Record
GHSA-5qv7-j6w5-fr4m- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVRUSTSEC-2026-0115No score
Fragile bounds check when sampling from image
A read of pixels was coded as modifying coordinates to lie within the image bounds. It would calculate a coordinate by adding a constant to an input and taking the minimum of the resulting coordinate and 'dimension - 1'. This would not protect against malicious inputs that could overflow the addition. . Subsequently to the tricked bounds check the image could then be sampled at multiple, differently calculated coordinates exceeding the bounds.
- Record
RUSTSEC-2026-0115- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.