GHSA-5QV7-J6W5-FR4M

imageproc has fragile bounds check when sampling from image

A read of pixels was coded as modifying coordinates to lie within the image bounds. It would calculate a coordinate by adding a constant to an input and taking the minimum of the resulting coordinate and 'dimension - 1'. This would not protect against malicious inputs that could overflow the addition. Following the tricked bounds check, the image could then be sampled at multiple differently calculated coordinates that exceeded the bounds.

An arithmetic operation produces a value that exceeds the integer type's maximum, causing it to wrap to an unexpected small value. Typical impact: incorrect size calculations leading to heap overflows or logic errors.

Kodem intelligence

Already deployed Kodem?

1. What is GHSA-5QV7-J6W5-FR4M? GHSA-5QV7-J6W5-FR4M is a medium-severity integer overflow or wraparound vulnerability in imageproc (rust), affecting versions = 0.24.0. It is fixed in 0.24.1, 0.25.1, 0.26.2. An arithmetic operation produces a value that exceeds the integer type's maximum, causing it to wrap to an unexpected small value.
2. Which versions of imageproc are affected by GHSA-5QV7-J6W5-FR4M? imageproc (rust) versions = 0.24.0 is affected.
3. Is there a fix for GHSA-5QV7-J6W5-FR4M? Yes. GHSA-5QV7-J6W5-FR4M is fixed in 0.24.1, 0.25.1, 0.26.2. Upgrade to this version or later.
4. Is GHSA-5QV7-J6W5-FR4M exploitable, and should I be worried? Whether GHSA-5QV7-J6W5-FR4M is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether GHSA-5QV7-J6W5-FR4M is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix GHSA-5QV7-J6W5-FR4M?
   • Upgrade imageproc to 0.24.1 or later
   • Upgrade imageproc to 0.25.1 or later
   • Upgrade imageproc to 0.26.2 or later

Other vulnerabilities in imageproc