CVE-2026-70377 in imagecli
Summary
by MITRE • 08/05/2026
imagecli's `scale <ratio>` pipeline operation (Scale::apply() in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. A large ratio (e.g. 100000) causes an attempted allocation of hundreds of terabytes, aborting the process. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability resides in imagecli's Scale::apply() function within src/image_ops.rs where the pipeline operation processes user-supplied scaling parameters without adequate input validation. This flaw enables a remote code execution vector through controlled denial of service by manipulating the scale ratio parameter. The implementation computes output dimensions using floating-point arithmetic followed by unchecked truncation to u32 integers, creating an exploitable condition where maliciously large ratios can trigger catastrophic memory allocation requests.
The technical implementation demonstrates a classic integer overflow and memory allocation vulnerability where the nom::number::complete::float parser accepts arbitrary floating-point values without range constraints. When users provide extremely large scaling ratios such as 100000, the computation (dimension as f32 * ratio) as u32 results in values that exceed system memory capacity, causing process termination during attempted allocation. This represents a fundamental lack of input sanitization and resource boundary checking in the image processing pipeline.
The operational impact of this vulnerability extends beyond simple denial of service to encompass remote crashability of applications that embed imagecli as a library component. Any system accepting user-controlled pipeline strings becomes immediately vulnerable to exploitation through a single malicious request containing an oversized scale ratio parameter. This creates a high-severity threat vector for web applications, API endpoints, and service interfaces that process untrusted image processing instructions.
Security implications align with CWE-190 Integer Overflow or Wraparound and CWE-704 Incorrect Type Conversion or Cast, while the exploitation pattern follows ATT&CK technique T1499.100 - Endpoint Denial of Service through resource exhaustion attacks. The vulnerability demonstrates poor defense-in-depth practices where input validation occurs at too high a level in the processing stack, allowing malformed parameters to propagate into critical system operations.
Mitigation strategies include implementing explicit range validation for scaling ratios before any arithmetic computation occurs, establishing maximum allowable values for user-supplied dimensions, and incorporating proper error handling for allocation failures. Applications should validate that computed output dimensions remain within reasonable bounds relative to available system resources, while also implementing timeouts and resource limits to prevent exploitation through memory exhaustion attacks. Additionally, input sanitization frameworks should be employed to ensure all pipeline parameters undergo strict validation before being processed by the core image operations engine.