GHSA-w5p8-4jcx-2j6r
imageproc: integer overflow in kernel size check leads to out-of-bounds read
GHSA-w5p8-4jcx-2j6r is a medium vulnerability (CVSS 6.9) in imageproc, published May 1, 2026. No source lists public exploit code. Fixed in imageproc 0.23.1.
- Severity
- 6.9 MediumCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.23.1imageproc +6 more
Description
A bounds verification of a slice storage of a 2-dimensional matrix's coefficients (a kernel) would compare the total size against the product of individual dimensions. This would erroneously cast after the multiplication and consequently fail to detect possible violations when overflow occurs.
Afterwards, the individual sizes were trusted to properly constrain coordinates within the matrix to indices valid for the underlying storage. With a crafted Kernel object, certain combinations of coordinates could then cause an out-of-bounds access in an unsafe function while fulfilling its documented preconditions. The kernel value could be passed to library functions that trusted the preconditions and then performed such reads.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Affected packages
| Package | Affected | Fixed |
|---|---|---|
imageproccrates.io | before 0.23.1 | 0.23.1 |
imageproccrates.io | 0.24.0 to 0.24.0 | 0.24.1 |
imageproccrates.io | 0.25.0 to 0.25.0 | 0.25.1 |
imageproccrates.io | 0.26.0 up to 0.26.2 | 0.26.2 |
imageproccrates.io | 0.24.0 up to 0.24.1 | 0.24.1 |
imageproccrates.io | 0.25.0 up to 0.25.1 | 0.25.1 |
imageproccrates.io | 0.0.0-0 up to 0.23.1, 0.24.0 up to 0.24.1, 0.25.0 up to 0.25.1, 0.26.0 up to 0.26.2 | 0.23.10.24.10.25.10.26.2 |
What each source reports
GitHub Advisories Score used
imageproc: integer overflow in kernel size check leads to out-of-bounds read
A bounds verification of a slice storage of a 2-dimensional matrix's coefficients (a kernel) would compare the total size against the product of individual dimensions. This would erroneously cast after the multiplication and consequently fail to detect possible violations when overflow occurs.
Afterwards, the individual sizes were trusted to properly constrain coordinates within the matrix to indices valid for the underlying storage. With a crafted Kernel object, certain combinations of coordinates could then cause an out-of-bounds access in an unsafe function while fulfilling its documented preconditions. The kernel value could be passed to library functions that trusted the preconditions and then performed such reads.
- Record
GHSA-w5p8-4jcx-2j6r- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-125, CWE-190
- Updated
- 2026-11-02
OSV
imageproc: integer overflow in kernel size check leads to out-of-bounds read
A bounds verification of a slice storage of a 2-dimensional matrix's coefficients (a kernel) would compare the total size against the product of individual dimensions. This would erroneously cast after the multiplication and consequently fail to detect possible violations when overflow occurs.
Afterwards, the individual sizes were trusted to properly constrain coordinates within the matrix to indices valid for the underlying storage. With a crafted Kernel object, certain combinations of coordinates could then cause an out-of-bounds access in an unsafe function while fulfilling its documented preconditions. The kernel value could be passed to library functions that trusted the preconditions and then performed such reads.
- Record
GHSA-w5p8-4jcx-2j6r- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-125, CWE-190
- Updated
- 2026-11-02
OSVRUSTSEC-2026-0116No score
Improper check of an invariant resulting in incorrect bounds checks
A bounds verification of a slice storage of a 2-dimensional matrix's coefficients (a kernel) would compare the total size against the product of individual dimensions. This would erroneously cast after the multiplication and consequently fail to detect possible violations when overflow occurs.
Afterwards, the individual sizes were trusted to properly constrain coordinates
within the matrix to indices valid for the underlying storage. With a crafted
Kernel object, certain combinations of coordinates could then cause an
out-of-bounds access in an unsafe function while fulfilling its documented
preconditions. The kernel value could be passed to library functions that
trusted the preconditions and then performed such reads.
- Record
RUSTSEC-2026-0116- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.