imagecli’s scale pipeline operation accepts an unbounded ratio value from the command line or embedded pipeline strings. The ratio is parsed as a floating‑point number without any range validation, and the resulting output dimensions are computed by scaling the original size. Supplying a large ratio, such as 100000, causes the program to attempt to allocate hundreds of terabytes of memory, leading to an abort and crash. The vulnerability allows a single malicious request to trigger a process termination, resulting in denial of service for the target application or system.

The vulnerable component is theimagecli tool maintained by theotherphil. The product can be used both as a standalone CLI for image processing and as a library that processes user‑supplied pipeline strings. No specific product versions are listed, but any instance that incorporates the current imagecli source code without applying bounds on the scale ratio is affected.

The vulnerability is scored 7.5 on the CVSS scale, indicating a high impact although no remote privilege escalation or data compromise is described. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through any application that accepts untrusted input to build an imagecli pipeline or by direct invocation of the CLI with a crafted ratio argument. A single request can exploit the bug, causing a crash and denial of service. Proper bounds checking or input validation would mitigate the risk.