The Thumbor convolution filter accepts a user-specified "columns" parameter and passes it directly to a C extension. If an attacker supplies a value of zero, the C code performs a divide‑by‑zero operation, triggering a fatal SIGFPE trap on x86_64 architectures. This causes the Thumbor process to crash, preventing it from handling further requests and creating a remote denial of service. The weakness is a failure to validate input (CWE‑20) and a divide‑by‑zero condition (CWE‑369).

All documented releases of thumbor before version 7.8.0 are impacted. The vulnerability exists in the filters:convolution filter implemented in thumbor/ext/filters/_convolution.c, and it is fixed in the 7.8.0 tag.

The fingerprint assigns a CVSS base score of 7.5, indicating a high severity remote vulnerability. The EPSS score is below the 1% threshold, suggesting a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers could trigger the flaw by sending an HTTP request to the convolution endpoint with the columns parameter set to zero. Because the code executes without authentication checks, the attack vector is remote and requires only network access to the Thumbor service. Once triggered, the process will terminate, exposing a temporary DoS condition until the service is restarted.