Listen to this Post
How the CVE Works
This vulnerability in the `imageproc` Rust crate arises from an unsafe integer multiplication during kernel size validation. The routine intended to verify that a kernel’s total storage size matches the product of its dimensions, that is, height width. The check compared the total byte size of the underlying slice against the result of width height.
The root cause is that the multiplication occurs before any overflow checking, and the product is cast to the target type after the multiplication. If the product of the dimensions exceeds the maximum value of the integer type used for the size (e.g., usize), the value wraps around (modulo 2^n). Consequently, an attacker can craft dimensions `width` and `height` such that `width height` overflows to the same value as the legitimate total size. Because the overflowed product matches the total size, it erroneously passes the bounds check.
After this check passes, the code trusts the provided dimensions to safely interact with the kernel’s storage. Using a specially crafted `Kernel` object, an attacker can supply coordinates that, when combined, fall outside the allocated memory range. Because the initial check was bypassed, these coordinate computations are no longer constrained to valid indices. Later, when an `unsafe` function accesses memory using these coordinates, the out-of-bounds read occurs, potentially leaking sensitive information.
DailyCVE Form
Platform: Rust (crates.io)
Version: <0.23.1,=0.24.0,=0.25.0,>=0.26.0<0.26.2
Vulnerability: Integer overflow OOB
Severity: Moderate
Date: 2026-05-07
Prediction: Patch date today
What Undercode Say
Check if your project depends on a vulnerable version of imageproc:
Check direct dependencies cargo tree | grep imageproc Check for vulnerable versions cargo audit
Examine the vulnerable bounds checking logic:
// The flawed invariant check (conceptual example) let ok = total_storage_size == (width height) as usize;
Exploit
To exploit this, an attacker needs to create a `Kernel` with dimensions `width` and `height` whose product overflows when stored in an unsigned integer type. For instance, on a 32-bit system, choosing `width = 65536` and `height = 65536` makes the product 4294967296, which overflows to 0. This tricks the bounds check as the overflowed product compares equal to the total storage size. Subsequently, specific coordinate pairs can cause the `unsafe` code to read or write beyond the kernel’s allocated memory.
Protection from this CVE
- Update immediately to the patched versions:
0.23.1,0.24.1,0.25.1, or `0.26.2` and above. - As a workaround, avoid using untrusted inputs in kernels.
- Enable language-level overflow checks (
-C overflow-checks=yes) to catch the issue at runtime before the bounds are circumvented.
Impact
An attacker can cause an out-of-bounds read of the kernel’s memory. This can lead to information disclosure, potentially exposing sensitive data from other parts of the application’s memory space. In some contexts, it might enable further exploitation such as a denial of service or, depending on the memory layout, information used in additional attack stages.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
