CVE-2026-70378: imagecli Carve Operation DoS Vulnerability

CVE-2026-70378 Overview

CVE-2026-70378 is a denial-of-service vulnerability in imagecli, a command-line image processing tool written in Rust. The flaw resides in the carve <ratio> pipeline operation implemented by Carve::apply() in src/image_ops.rs. The function asserts that ratio <= 1.0 but never validates that the ratio is positive. A negative ratio value causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast semantics. The zero-width value is then passed to imageproc::seam_carving::shrink_width, which panics when supplied a width below 2. The panic terminates the process. This weakness is tracked under [CWE-1284] (Improper Validation of Specified Quantity in Input).

Critical Impact
An attacker who can supply pipeline arguments to imagecli can crash the process by passing a negative carve ratio such as -5, resulting in availability loss for any service that invokes the tool on untrusted input.

Affected Products

imagecli (Rust image processing CLI by theotherphil)
Carve::apply() in src/image_ops.rs
Downstream integrations invoking imageproc::seam_carving::shrink_width through imagecli's carve operation

Discovery Timeline

2026-08-05 - CVE-2026-70378 published to the National Vulnerability Database (NVD)
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70378

Vulnerability Analysis

The carve <ratio> operation is intended to reduce an image's width by a fractional ratio using seam carving. The implementation enforces an upper bound with assert!(ratio <= 1.0) but omits a lower-bound check. When a caller passes a negative floating-point ratio, Rust's defined f32 as u32 conversion saturates negative values to 0 rather than producing undefined behavior. The zero value flows into imageproc::seam_carving::shrink_width, which requires a target width of at least 2. The library panics on that precondition failure, and the unwinding panic terminates the entire imagecli process.

The defect shares a root cause with a sibling scale operation defect in the same file: neither validates the sign or minimum size of the caller-supplied ratio before performing arithmetic and passing derived values into downstream image processing routines.

Root Cause

The root cause is missing input validation on a numeric ratio parameter. The assertion enforces only the upper bound, allowing negative values to bypass validation. Rust's saturating cast then masks the invalid input by producing 0, which violates the downstream API contract requiring a width >= 2.

Attack Vector

An attacker supplies a crafted pipeline expression containing a negative ratio (for example, carve -5) to any interface that forwards user input to imagecli. The tool computes a zero target width, invokes shrink_width, and panics. In network-exposed services that shell out to imagecli for image transformations, a single request can terminate the worker process. See the GitHub Issue Discussion for the reporter's reproduction.

Detection Methods for CVE-2026-70378

Indicators of Compromise

Process crashes or worker restarts correlated with imagecli invocations that include the carve pipeline operation
Panic messages referencing imageproc::seam_carving::shrink_width or a target width below 2 in application logs
Inbound requests containing negative numeric arguments to image transformation endpoints backed by imagecli

Detection Strategies

Inspect application logs for Rust panic traces originating in Carve::apply() or shrink_width and alert on repeated occurrences from the same source
Instrument the wrapper invoking imagecli to log the full pipeline string and flag any carve argument with a leading minus sign
Correlate HTTP 5xx spikes with image upload or processing endpoints that pass user-controlled parameters to imagecli

Monitoring Recommendations

Track panic and non-zero exit codes for the imagecli process across the fleet
Monitor request-to-crash ratios on image processing services to identify probing attempts
Retain full command-line arguments in audit logs so post-incident analysis can attribute crashes to specific inputs

How to Mitigate CVE-2026-70378

Immediate Actions Required

Reject any user-supplied pipeline argument containing negative numeric values before invoking imagecli
Sandbox the imagecli process and enforce automatic restart so a panic does not degrade the parent service
Add an allowlist of pipeline operations and validate each numeric parameter against explicit ranges

Patch Information

No vendor patch identifier is listed in the enriched CVE data at time of publication. Track the upstream fix through the GitHub Issue Discussion and apply the patched release once available. A minimal upstream fix would add a lower-bound assertion such as ratio > 0.0 in Carve::apply() and clamp or reject widths below the shrink_width minimum.

Workarounds

Wrap imagecli invocations in a validation layer that rejects ratios outside (0.0, 1.0]
Replace direct shell invocation with a controlled API surface that parses and validates each operation before dispatch
Run imagecli under a process supervisor that restarts crashed workers to preserve service availability

bash

# Configuration example: pre-validate carve ratio before invoking imagecli
ratio="$1"
awk -v r="$ratio" 'BEGIN{exit !(r+0 > 0 && r+0 <= 1)}' || { echo "invalid ratio"; exit 1; }
imagecli -i in.png -o out.png -p "carve $ratio"