Technical impact
The vulnerability lies in the crop() function of the raster crate, where offset coordinates are bounded only by zero but not by the image dimensions. This oversight can allow a caller to supply offsets that exceed the source width or height, leading to an attempt to create a buffer with a negative or excessively large size. Such an operation can cause an integer underflow that propagates to a call that allocates a buffer with a negative or oversized capacity, potentially resulting in a panic that terminates the process or otherwise disrupts normal operation.
Affected Systems
Affected product is the raster crate from the kosinix vendor. Any application or service that incorporates this crate and processes image crop requests with user‑controlled or external offsets may be impacted. The description does not list specific version numbers, so all releases containing the unpatched crop() implementation are susceptible until a corrected version is released.
Risk and Exploitability
With a CVSS score of 7.5 the vulnerability is high severity. The EPSS score of < 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA KEV. The most likely attack vectors are those that allow an attacker to control or influence the crop offset parameters— for example, a remote image upload endpoint or a local image processing task. Although the description does not explicitly state that the flaw would crash the application, it is inferred that supplying out‑of‑range offsets could trigger a panic leading to a denial‑of‑service condition. Because the crate is used by multiple applications, any exposed functionality that invokes crop() without additional validation could be at risk.
