CVE-2019-16138
Use after free in image
An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.
- Record
CVE-2019-16138- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.
- Record
CVE-2019-16138- Updated
- 2026-11-02
EUVDEUVD-2021-1787 No score
An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.
- Record
EUVD-2021-1787- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m2pf-hprp-3vqm
Use after free in image
Affected versions of this crate would call Vec::set_len on an uninitialized vector with user-provided type parameter, in an interface of the HDR image format decoder. They would then also call other code that could panic before initializing all instances.
This could run Drop implementations on uninitialized types, equivalent to use-after-free, and allow an attacker arbitrary code execution.
Two different fixes were applied. It is possible to conserve the interface by ensuring proper initialization before calling Vec::set_len. Drop is no longer called in case of panic, though.
Starting from version 0.22, a breaking change to the interface requires callers to pre-allocate the output buffer and pass a mutable slice instead, avoiding all unsafe code.
- Record
GHSA-m2pf-hprp-3vqm- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSV
An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.
- Record
CVE-2019-16138- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-m2pf-hprp-3vqm
Use after free in image
Affected versions of this crate would call Vec::set_len on an uninitialized vector with user-provided type parameter, in an interface of the HDR image format decoder. They would then also call other code that could panic before initializing all instances.
This could run Drop implementations on uninitialized types, equivalent to use-after-free, and allow an attacker arbitrary code execution.
Two different fixes were applied. It is possible to conserve the interface by ensuring proper initialization before calling Vec::set_len. Drop is no longer called in case of panic, though.
Starting from version 0.22, a breaking change to the interface requires callers to pre-allocate the output buffer and pass a mutable slice instead, avoiding all unsafe code.
- Record
GHSA-m2pf-hprp-3vqm- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVRUSTSEC-2019-0014
Flaw in interface may drop uninitialized instance of arbitrary types
Affected versions of this crate would call Vec::set_len on an uninitialized
vector with user-provided type parameter, in an interface of the HDR image
format decoder. They would then also call other code that could panic before
initializing all instances.
This could run Drop implementations on uninitialized types, equivalent to use-after-free, and allow an attacker arbitrary code execution.
Two different fixes were applied. It is possible to conserve the interface by
ensuring proper initialization before calling Vec::set_len. Drop is no longer
called in case of panic, though.
Starting from version 0.22, a breaking change to the interface requires
callers to pre-allocate the output buffer and pass a mutable slice instead,
avoiding all unsafe code.
- Record
RUSTSEC-2019-0014- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
imagecrates.io |
0.10.2 up to 0.21.3 | 0.21.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-16138 is a critical vulnerability (CVSS 9.8) in Image-rs Image, published August 21, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.48%, the 84th percentile. Fixed in image 0.21.3.