N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-5qv7-j6w5-fr4m

GHSA-5qv7-j6w5-fr4m: imageproc has fragile bounds check when sampling from image

A read of pixels was coded as modifying coordinates to lie within the image bounds. It would calculate a coordinate by adding a constant to an input and taking the minimum of the resulting coordinate and 'dimension - 1'. This would not protect against malicious inputs that could overflow the addition. Following the tricked bounds check, the image could then be sampled at multiple differently calculated coordinates that exceeded the bounds.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-5qv7-j6w5-fr4m

GHSA-5qv7-j6w5-fr4m:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
imageproc	rust	= 0.24.0	0.24.1
imageproc	rust	= 0.25.0	0.25.1
imageproc	rust	>= 0.26.0, < 0.26.2	0.26.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an integer overflow in the imageproc crate that leads to an out-of-bounds memory read. The root cause is a lack of input validation combined with unsafe arithmetic in the BRIEF feature descriptor implementation.

The public API imageproc::binary_descriptors::brief accepts user-provided TestPair coordinates. It passes this data to the internal function brief_impl.
brief_impl did not validate that the coordinates in the TestPairs were within the expected bounds of an image patch. It would calculate new coordinates by adding an offset to the user-provided values.
These potentially very large, malicious coordinates were then passed to imageproc::binary_descriptors::local_pixel_average.
Inside local_pixel_average, the code calculated a bounding box to sample pixels. The calculation for the maximum coordinates (x_max, y_max) used simple addition (x + radius + 1). When provided with a large coordinate near u32::MAX, this addition would overflow in release builds, wrapping around to a small value.
This created an invalid bounding box where x_max could be smaller than x_min. The subsequent check for an empty area was bypassed, and an unsafe_get_pixel call was made with the very large x_min value, resulting in a read past the allocated image buffer.

The patch addresses this by adding validation in brief_impl to reject out-of-range TestPair coordinates and by using saturating_add in local_pixel_average to prevent the integer overflow. During exploitation, a profiler would show a call to brief, which then calls brief_impl and local_pixel_average, where the memory error occurs.

Vulnerable functions

imageproc::binary_descriptors::local_pixel_average

src/binary_descriptors/brief.rs

This function calculates pixel averages. The calculation for `x_max` and `y_max` used standard addition, which could overflow if a large `x` or `y` coordinate was passed in. This overflow would cause the bounds check to be bypassed, leading to an out-of-bounds read when `unsafe_get_pixel` is called later in the function. The patch replaces the addition with `saturating_add` to prevent the overflow.

imageproc::binary_descriptors::brief_impl

src/binary_descriptors/brief.rs

This function is the internal implementation for the BRIEF descriptor. It failed to validate that the coordinates of the user-supplied `test_pairs` were within the expected patch diameter. This allowed malicious, large coordinate values to be passed to the `local_pixel_average` function, triggering an integer overflow. The patch adds a loop to validate these coordinates before they are used.

imageproc::binary_descriptors::brief

src/binary_descriptors/brief.rs

This is the public entry point for the BRIEF descriptor functionality. It accepts user-controlled `TestPair` data and passes it down to the vulnerable `brief_impl` function without sanitization. An attacker would call this function to initiate the exploit chain.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.