How severe is GHSA-5qv7-j6w5-fr4m?

No CVSS score has been assigned to GHSA-5qv7-j6w5-fr4m yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-5qv7-j6w5-fr4m?

GHSA-5qv7-j6w5-fr4m affects the following packages: imageproc (crates.io), imageproc (crates.io), imageproc (crates.io). Ecosystems affected: crates.io.

How do I fix GHSA-5qv7-j6w5-fr4m?

Update imageproc to 0.24.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5qv7-j6w5-fr4m is resolved across your whole dependency graph.

How do I detect GHSA-5qv7-j6w5-fr4m in my crates.io dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for imageproc, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-5qv7-j6w5-fr4m if there is no patch (or I can't update yet)?

Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Is GHSA-5qv7-j6w5-fr4m actively exploited in the wild?

No public exploit code has been indexed for GHSA-5qv7-j6w5-fr4m yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-5qv7-j6w5-fr4m published, and has it been updated?

GHSA-5qv7-j6w5-fr4m was published on May 7, 2026 and was last updated on May 7, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

GHSA-5qv7-j6w5-fr4m: imageproc

Real-World Exposure

3 pkgs affected

🦀imageproc🦀imageproc🦀imageproc

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.

Description

A read of pixels was coded as modifying coordinates to lie within the image bounds. It would calculate a coordinate by adding a constant to an input and taking the minimum of the resulting coordinate and 'dimension - 1'. This would not protect against malicious inputs that could overflow the addition. Following the tricked bounds check, the image could then be sampled at multiple differently calculated coordinates that exceeded the bounds.

Affected Packages

3 total 3 fixed

Ecosystem	Package	Vulnerable range	Fix
🦀crates.io	`imageproc`	≥ 0.24.0&&< 0.24.1	0.24.1`cargo update -p imageproc --precise 0.24.1`
🦀crates.io	`imageproc`	≥ 0.25.0&&< 0.25.1	0.25.1`cargo update -p imageproc --precise 0.25.1`
🦀crates.io	`imageproc`	≥ 0.26.0&&< 0.26.2	0.26.2`cargo update -p imageproc --precise 0.26.2`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for imageproc, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update imageproc to 0.24.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5qv7-j6w5-fr4m is resolved across your whole dependency graph.
Workarounds
Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Frequently Asked Questions

A read of pixels was coded as modifying coordinates to lie within the image bounds. It would calculate a coordinate by adding a constant to an input and taking the minimum of the resulting coordinate and 'dimension - 1'. This would not protect against malicious inputs that could overflow the addition. Following the tricked bounds check, the image could then be sampled at multiple differently calculated coordinates that exceeded the bounds.

O3 Security · Impact-Aware SCA

Is GHSA-5qv7-j6w5-fr4m in your dependencies?

Find it across crates.io, including transitive dependencies.

Scan my dependencies How O3 SCA works

imageproc has fragile bounds check when sampling from imageGHSA-5qv7-j6w5-fr4m