N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-qg8r-f7x3-25f7

GHSA-qg8r-f7x3-25f7: imageproc: Out-of-bounds read via NaN coordinates in bilinear/bicubic sampling

A bounds check was performed in floating points before a cast to the index passed to an unchecked access function. This checked considered NaN cases improperly, causing them to succeed the check instead of failing it. The floating point coordinate is under caller control by passing a selected projection matrix.

Carefully controlling the coordinates of an image with no data and one non-zero dimension provides an arbitrary read primitive in the first 32-bits of address space with a Bilinear sampling method.

Using bicubic sampling can result in a read of a few bytes beyond an allocation.

Other out-of-bounds reads may be possible.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-qg8r-f7x3-25f7

GHSA-qg8r-f7x3-25f7:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
imageproc	rust	< 0.23.1	0.23.1
imageproc	rust	= 0.24.0	0.24.1
imageproc	rust	= 0.25.0	0.25.1
imageproc	rust	>= 0.26.0, < 0.26.2	0.26.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an out-of-bounds read in the imageproc library caused by improper handling of NaN (Not a Number) floating-point coordinates. The root cause lies in several interpolation functions (interpolate_bilinear, interpolate_bicubic, interpolate_nearest) within the geometric_transformations.rs file. These functions performed bounds checks using a series of OR (||) conditions. In floating-point arithmetic, any comparison involving NaN (e.g., NaN < 0.0) evaluates to false. Consequently, if an attacker supplied a NaN coordinate, all parts of the bounds check would evaluate to false, causing the check to be bypassed and allowing code in the else block, which contained unsafe memory access, to be executed with invalid indices.

The patch addresses this by inverting the logic. It replaces the negative checks with positive checks combined with AND (&&) operators (e.g., x >= 0.0 && x < width). With this change, if x is NaN, the first part of the condition (NaN >= 0.0) is false, causing the entire expression to be false and correctly preventing the unsafe code from being executed.

The public-facing API functions warp_into and warp_into_with are the primary entry points for this vulnerability, as they take user-controlled transformations or mappings that can be crafted to produce NaN coordinates and then pass them to the vulnerable interpolation functions. Therefore, a runtime profile during exploitation would show calls originating from warp_into or warp_into_with and leading to one of the vulnerable interpolate_* functions.

Vulnerable functions

interpolate_bilinear

src/geometric_transformations.rs

The function's bounds check used a series of OR conditions (`||`). When provided with a NaN coordinate, all comparisons return false, causing the check to be bypassed and leading to an out-of-bounds read via `image.unsafe_get_pixel`. The patch inverts the logic to use AND conditions (`&&`) with positive checks, which correctly rejects NaN values.

interpolate_bicubic

src/geometric_transformations.rs

Similar to `interpolate_bilinear`, this function's bounds check was flawed. A NaN coordinate would cause the check to fail open, allowing the `unsafe` block containing `image.unsafe_get_pixel` to be executed with out-of-bounds indices. The patch corrects the conditional logic to properly handle NaN inputs.

interpolate_nearest

src/geometric_transformations.rs

The function performed a bounds check on rounded coordinates. A NaN coordinate, when rounded, could remain NaN. The original check using `||` would be bypassed by a NaN value, leading to an out-of-bounds read in the `unsafe` block. The patch fixes this by changing the check to correctly reject NaN values.

warp_into

src/geometric_transformations.rs

This function is a public API entry point for the vulnerability. It takes user-controlled parameters (including a projection that can generate NaN coordinates) and an interpolation method, then calls the corresponding vulnerable, lower-level interpolation function (`interpolate_bilinear`, `interpolate_bicubic`, or `interpolate_nearest`), leading to the out-of-bounds read.

warp_into_with

src/geometric_transformations.rs

This function is a public API entry point for the vulnerability. It takes a user-controlled mapping function which can produce NaN coordinates. It then calls one of the vulnerable interpolation functions based on the specified interpolation method, triggering the out-of-bounds read. It would appear in a runtime profile during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.