https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T14:46:26.121794+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349615 EUVD-2026-349615 2026-10-05T14:46:26.168983+00:00 EUVD-2026-349615 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71202 fkie_cve-2026-71202 2026-10-05T14:46:26.169019+00:00

The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height.

 https://cve.radiocsirt.org/vuln/ghsa-hjwh-6x9j-wjwq GHSA-hjwh-6x9j-wjwq 2026-10-05T14:46:26.169053+00:00

The raster Rust crate's crop() function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height. When an offset exceeds the corresponding source dimension, `width2 - offset_x` (or the height equivalent) underflows to a negative i32, which release builds do not trap; the negative value is then cast to usize inside Image::blank()'s Vec::with_capacity() call, triggering a capacity-overflow panic and crashing the process on a single crafted crop request.