{"id":"RUSTSEC-2026-0116","summary":"Improper check of an invariant resulting in incorrect bounds checks","details":"A bounds verification of a slice storage of a 2-dimensional matrix's\ncoefficients (a kernel) would compare the total size against the product of\nindividual dimensions. This would erroneously cast *after* the multiplication\nand consequently fail to detect possible violations when overflow occurs.\n\nAfterwards, the individual sizes were trusted to properly constrain coordinates\nwithin the matrix to indices valid for the underlying storage. With a crafted\n`Kernel` object, certain combinations of coordinates could then cause an\nout-of-bounds access in an `unsafe` function while fulfilling its documented\npreconditions. The kernel value could be passed to library functions that\ntrusted the preconditions and then performed such reads.","aliases":["GHSA-w5p8-4jcx-2j6r"],"modified":"2026-05-07T08:56:41Z","published":"2026-05-01T12:00:00Z","related":["https://github.com/image-rs/imageproc/pull/777"],"database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/imageproc"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0116.html"}],"affected":[{"package":{"name":"imageproc","ecosystem":"crates.io","purl":"pkg:cargo/imageproc"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.23.1"},{"introduced":"0.24.0"},{"fixed":"0.24.1"},{"introduced":"0.25.0"},{"fixed":"0.25.1"},{"introduced":"0.26.0"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["memory-exposure"],"cvss":null,"informational":"unsound","source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0116.json"}}],"schema_version":"1.7.5"}