CVE-2019-16138

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-09-09 · updated 2026-06-17
Weakness: CWE-416

Description

An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.

Affected products

Image-Rs Image: from 0.10.2 before 0.21.3 — fixed in 0.21.3

How to fix

Upgrade to a fixed version: Image-Rs Image 0.21.3. Check the vendor advisory for mitigations.

References

https://github.com/image-rs/image/pull/985
https://rustsec.org/advisories/RUSTSEC-2019-0014.html
https://github.com/image-rs/image/pull/985
https://rustsec.org/advisories/RUSTSEC-2019-0014.html

Get alerted when CVE-2019-16138 or the next vulnerability affects your stack