imagecli’s carve operation accepts a ratio argument. The code only checks that the ratio is less than or equal to one and ignores whether it is negative. When a negative value such as –5 is supplied, the calculated target width becomes zero after a float-to‐uint cast and subsequently triggers a panic in the seam‑carving routine because the width is below the required minimum of two. This panic causes the entire imagecli process to terminate, leading to a denial of service for any user depending on that process. The weakness is an instance of missing input validation (CWE-1284).

The vulnerable component is the imagecli utility from theotherphil. No specific product version is identified in the CVE data; therefore any release of imagecli that contains the unpatched carve routine is potentially affected.

The reported CVSS score is 7.5, indicating a high severity vulnerability. EPSS data is not available, so the likelihood of exploitation is unclear, but the simple nature of the input requirement (a numeric ratio) means that exploitation is technically straightforward. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or remote if imagecli receives user input via a network service or command line; a malicious actor could supply a negative ratio to trigger the crash and disrupt availability.