{"id":"CVE-2019-16138","aliases":["EUVD-2021-1787","GHSA-m2pf-hprp-3vqm","RUSTSEC-2019-0014"],"status":"published","title":"Use after free in image","description":"An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02478,"percentile":0.84681,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2019-08-21T12:00:00Z","modified":"2026-10-20T10:50:48Z","fixes":[{"ecosystem":"crates.io","package":"image","fixed_in":["0.21.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.2"},{"fixed":"0.21.3"}]}]},{"source":"osv","ecosystem":"crates.io","package":"image","ranges":[{"type":"SEMVER","events":[{"introduced":"0.10.2"},{"fixed":"0.21.3"}]}]},{"source":"osv","ecosystem":"crates.io","package":"image","ranges":[{"type":"SEMVER","events":[{"introduced":"0.10.2"},{"fixed":"0.21.3"}]}]}],"products":[{"vendor":"image-rs","product":"image"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2019-0014.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/image-rs/image/pull/985","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16138","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m2pf-hprp-3vqm"},{"url":"https://github.com/image-rs/image","tags":["package"]},{"url":"https://crates.io/crates/image","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2019-16138","description":"An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.","status":"published","published":"2019-09-09T11:49:30Z","modified":"2024-08-05T01:10:41.367Z","updated_at":"2026-11-02T14:32:23.485011Z"}],"euvd":[{"id":"EUVD-2021-1787","description":"An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.","status":"published","published":"2019-09-09T11:49:30Z","modified":"2024-08-05T01:10:41Z","updated_at":"2026-11-03T02:40:33.179924Z"}],"ghsa":[{"id":"GHSA-m2pf-hprp-3vqm","title":"Use after free in image","description":"Affected versions of this crate would call Vec::set_len on an uninitialized vector with user-provided type parameter, in an interface of the HDR image format decoder. They would then also call other code that could panic before initializing all instances.\n\nThis could run Drop implementations on uninitialized types, equivalent to use-after-free, and allow an attacker arbitrary code execution.\n\nTwo different fixes were applied. It is possible to conserve the interface by ensuring proper initialization before calling Vec::set_len. Drop is no longer called in case of panic, though.\n\nStarting from version 0.22, a breaking change to the interface requires callers to pre-allocate the output buffer and pass a mutable slice instead, avoiding all unsafe code.","status":"published","published":"2021-08-25T20:44:43Z","modified":"2023-06-13T18:18:17Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:36:53.654352Z"}],"nvd":[{"id":"CVE-2019-16138","description":"An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.","status":"published","published":"2019-09-09T12:15:10.71Z","modified":"2026-06-17T02:21:44.633Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:05:25.691233Z"}],"osv":[{"id":"CVE-2019-16138","description":"An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.","status":"published","published":"2019-09-09T12:15:10.71Z","modified":"2026-10-20T10:50:48.495241112Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:11.361782Z"},{"id":"GHSA-m2pf-hprp-3vqm","title":"Use after free in image","description":"Affected versions of this crate would call Vec::set_len on an uninitialized vector with user-provided type parameter, in an interface of the HDR image format decoder. They would then also call other code that could panic before initializing all instances.\n\nThis could run Drop implementations on uninitialized types, equivalent to use-after-free, and allow an attacker arbitrary code execution.\n\nTwo different fixes were applied. It is possible to conserve the interface by ensuring proper initialization before calling Vec::set_len. Drop is no longer called in case of panic, though.\n\nStarting from version 0.22, a breaking change to the interface requires callers to pre-allocate the output buffer and pass a mutable slice instead, avoiding all unsafe code.","status":"published","published":"2021-08-25T20:44:43Z","modified":"2023-11-08T04:01:16.102637Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"RUSTSEC-2019-0014","title":"Flaw in interface may drop uninitialized instance of arbitrary types","description":"Affected versions of this crate would call `Vec::set_len` on an uninitialized\nvector with user-provided type parameter, in an interface of the HDR image\nformat decoder. They would then also call other code that could panic before\ninitializing all instances.\n\nThis could run Drop implementations on uninitialized types, equivalent to\nuse-after-free, and allow an attacker arbitrary code execution.\n\nTwo different fixes were applied. It is possible to conserve the interface by\nensuring proper initialization before calling `Vec::set_len`. Drop is no longer\ncalled in case of panic, though.\n\nStarting from version `0.22`, a breaking change to the interface requires\ncallers to pre-allocate the output buffer and pass a mutable slice instead,\navoiding all unsafe code.","status":"published","published":"2019-08-21T12:00:00Z","modified":"2023-11-08T04:01:16.102637Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}