CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2019-16138
Critical (9.8) in image-rs image. EPSS 2.5% chance of exploitation in the next 30 days. Fixed in image 0.21.3.
An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.
Severity
- EPSS
- 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
- CWE
- CWE-416
- Published
- Modified
- Record from
- the NVD, synced
Affected
- image-rs:image
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m2pf-hprp-3vqm | crates.io | image | >=0.10.2 <0.21.3 | 0.21.3 |
| RUSTSEC-2019-0014 | crates.io | image | >=0.10.2 <0.21.3 | 0.21.3 |