RUSTSEC-2026-0115: Fragile bounds check when sampling from image

What to do

1. See which version you have: cargo tree -i imageproc (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p imageproc. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example imageproc = "0.26.2") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

A read of pixels was coded as modifying coordinates to lie within the image bounds. It would calculate a coordinate by adding a constant to an input and taking the minimum of the resulting coordinate and 'dimension - 1'. This would not protect against malicious inputs that could overflow the addition. . Subsequently to the tricked bounds check the image could then be sampled at multiple, differently calculated coordinates exceeding the bounds.

References

• Package: crates.io/crates/imageproc
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0115.html

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for imageproc

• UnsoundRUSTSEC-2026-0116 · 2026-05-01Improper check of an invariant resulting in incorrect bounds checks
• UnsoundRUSTSEC-2026-0117 · 2026-05-01Fragile bounds check when sampling from image

Full security history of imageproc