The vulnerability is an integer underflow in the crop() function of the raster crate, where the width and height are clamped but the offset values are only clamped against zero. When an offset exceeds the source width or height, the subtraction produces a negative i32 which is silently truncated in release builds. That negative value is then cast to a usize in a Vec::with_capacity() call, causing a capacity‑overflow panic that crashes the process on a single crafted crop request. The result is a denial of service: the application terminates as soon as the invalid request is processed, potentially leading to downtime or forceful restarts.

Affected product is the raster crate from the kosinix vendor. Any application or service that incorporates this crate and processes image crop requests with user‑controlled or external offsets may be impacted. The description does not list specific version numbers, so all releases containing the unpatched crop() implementation are susceptible until a corrected version is released.

With a CVSS score of 7.5 the vulnerability is high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, so the current likelihood of exploitation is uncertain. The attack vector is inferred to be either local, through a malicious payload, or remote if the crate is used in a publicly exposed service that accepts image data. The lack of access control barriers and the severe service disruption make this a priority for remediation.