{"id":"GHSA-qg8r-f7x3-25f7","aliases":["RUSTSEC-2026-0117"],"status":"published","title":"imageproc: Out-of-bounds read via NaN coordinates in bilinear/bicubic sampling","description":"A bounds check was performed in floating points before a cast to the index passed to an unchecked access function. This checked considered `NaN` cases improperly, causing them to succeed the check instead of failing it. The floating point coordinate is under caller control by passing a selected projection matrix.\n\nCarefully controlling the coordinates of an image with no data and one non-zero dimension provides an arbitrary read primitive in the first 32-bits of address space with a Bilinear sampling method.\n\nUsing bicubic sampling can result in a read of a few bytes beyond an allocation.\n\nOther out-of-bounds reads may be possible.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-05-01T12:00:00Z","modified":"2026-09-10T03:51:06Z","fixes":[{"ecosystem":"crates.io","package":"imageproc","fixed_in":["0.23.1","0.24.1","0.25.1","0.26.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"imageproc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.1"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"imageproc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.24.0"},{"last_affected":"0.24.0"},{"fixed":"0.24.1"}]}],"versions":["0.24.0"]},{"source":"ghsa","ecosystem":"crates.io","package":"imageproc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.25.0"},{"last_affected":"0.25.0"},{"fixed":"0.25.1"}]}],"versions":["0.25.0"]},{"source":"ghsa","ecosystem":"crates.io","package":"imageproc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.0"},{"fixed":"0.26.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"imageproc","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"imageproc","ranges":[{"type":"SEMVER","events":[{"introduced":"0.24.0"},{"fixed":"0.24.1"}]}],"versions":["0.24.0"]},{"source":"osv","ecosystem":"crates.io","package":"imageproc","ranges":[{"type":"SEMVER","events":[{"introduced":"0.25.0"},{"fixed":"0.25.1"}]}],"versions":["0.25.0"]},{"source":"osv","ecosystem":"crates.io","package":"imageproc","ranges":[{"type":"SEMVER","events":[{"introduced":"0.26.0"},{"fixed":"0.26.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"imageproc","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.23.1"},{"introduced":"0.24.0"},{"fixed":"0.24.1"},{"introduced":"0.25.0"},{"fixed":"0.25.1"},{"introduced":"0.26.0"},{"fixed":"0.26.2"}]}]}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0117.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qg8r-f7x3-25f7"},{"url":"https://github.com/image-rs/imageproc","tags":["package"]},{"url":"https://crates.io/crates/imageproc","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-qg8r-f7x3-25f7","title":"imageproc: Out-of-bounds read via NaN coordinates in bilinear/bicubic sampling","description":"A bounds check was performed in floating points before a cast to the index passed to an unchecked access function. This checked considered `NaN` cases improperly, causing them to succeed the check instead of failing it. The floating point coordinate is under caller control by passing a selected projection matrix.\n\nCarefully controlling the coordinates of an image with no data and one non-zero dimension provides an arbitrary read primitive in the first 32-bits of address space with a Bilinear sampling method.\n\nUsing bicubic sampling can result in a read of a few bytes beyond an allocation.\n\nOther out-of-bounds reads may be possible.","status":"published","published":"2026-05-07T03:10:13Z","modified":"2026-05-07T03:10:15Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:40:03.762927Z"}],"osv":[{"id":"GHSA-qg8r-f7x3-25f7","title":"imageproc: Out-of-bounds read via NaN coordinates in bilinear/bicubic sampling","description":"A bounds check was performed in floating points before a cast to the index passed to an unchecked access function. This checked considered `NaN` cases improperly, causing them to succeed the check instead of failing it. The floating point coordinate is under caller control by passing a selected projection matrix.\n\nCarefully controlling the coordinates of an image with no data and one non-zero dimension provides an arbitrary read primitive in the first 32-bits of address space with a Bilinear sampling method.\n\nUsing bicubic sampling can result in a read of a few bytes beyond an allocation.\n\nOther out-of-bounds reads may be possible.","status":"published","published":"2026-05-07T03:10:13Z","modified":"2026-09-10T03:51:06.79919677Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"RUSTSEC-2026-0117","title":"Fragile bounds check when sampling from image","description":"A bounds check was performed in floating points before a cast to the index\npassed to an unchecked access function. This checked considered `NaN` cases\nimproperly, causing them to succeed the check instead of failing it. The\nfloating point coordinate is under caller control by passing a selected\nprojection matrix.\n\nCarefully controlling the coordinates of an image with no data and one non-zero\ndimension provides an arbitrary read primitive in the first 32-bits of address\nspace with a Bilinear sampling method.\n\nUsing bicubic sampling can result in a read of a few bytes beyond an allocation.\n\nOther out-of-bounds reads may be possible.","status":"published","published":"2026-05-01T12:00:00Z","modified":"2026-05-07T08:56:41Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}