Agrresore

**Name of the Vulnerable Software and Affected Versions** imagecli (affected versions not specified) **Description** The `scale <ratio>` pipeline operation in the `Scale::apply()` function (located in src/image ops.rs) calculates output dimensions by multiplying the current dimension by a ratio. Because the `ratio` variable, parsed via `nom::number::complete::float`, lacks upper-bound validation or range checks, providing an excessively large value can trigger an attempt to allocate hundreds of terabytes of memory. This leads to a process abort, allowing any application that embeds imagecli as a library and accepts user-controlled pipeline strings to be crashed remotely with a single request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** imagecli (affected versions not specified) **Description** The `carve <ratio>` pipeline operation fails to validate that the `ratio` variable is positive. When a negative value is provided, the computed target width saturates to 0 during a float-to-uint cast. This value is then passed to the `shrink width()` function in the `imageproc::seam carving` module, which triggers a panic and crashes the process if the width is less than 2. This issue occurs within the `Carve::apply()` function located in `src/image ops.rs`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** raster Rust crate (affected versions not specified) **Description** The `crop()` function (src/editor.rs) fails to properly clamp the `offset x` and `offset y` parameters against the source width and height, only clamping them against 0. If an offset exceeds the source dimensions, the calculation `width2 - offset x` (or the height equivalent) underflows to a negative i32. In release builds, this negative value is cast to a usize within the `Vec::with capacity()` call of the `Image::blank()` function, leading to a capacity-overflow panic that crashes the process when a crafted crop request is processed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.