imagecli’s carve operation, implemented in Carve::apply, validates that the supplied ratio is no greater than one but does not verify that it is positive. Supplying a negative ratio such as –5 causes the computed target width to clamp to zero through Rust’s defined float‑to‑uint cast. This zero width is then passed to imageproc::seam_carving::shrink_width, which panics when the width is less than two, terminating the imagecli process. The result is a denial of service for any user relying on the utility. The flaw is an instance of missing input validation (CWE-1284).

The vulnerable component is the imagecli utility from theotherphil. No specific product version is identified in the CVE data; therefore any release of imagecli that contains the unpatched carve routine is potentially affected.

The reported CVSS score is 7.5, indicating a high severity vulnerability. The EPSS score is <1%, reflecting a very low but nonzero exploitation probability, yet the simple numeric input requirement means that exploitation is technically straightforward. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or remote if imagecli receives user input via a network service or command line; a malicious actor could supply a negative ratio to trigger the crash and disrupt availability.