CVE-2026-70377 theotherphil CVE debrief

Who should care

Developers using the imagecli library, administrators of systems using imagecli, and security teams monitoring for vulnerabilities in libraries should be aware of this remote crash vulnerability. They should verify imagecli library versions, restrict user-controlled pipeline strings, and monitor for similar vulnerabilities in other libraries. Asset inventory and vulnerability management teams should also review compensating controls for exposed systems while remediation is scheduled and verified. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Operators and platform teams should review relevant monitoring, detection, and logs for exposed assets that need extra review. Vulnerability management teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Security teams should also review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Security teams should also consider rollback/change windows for remediation and source tracking for affected product deployments. Security teams should also consider compensating controls for exposed systems while remediation is scheduled and verified. Security teams should also review asset inventory for affected product deployments and assign an owner for follow-up. Security teams should also review relevant monitoring, detection, and logs for exposed assets that need extra review. Security teams should also track exceptions, retest remediated assets, and close the item only after evidence is documented. Security teams should also consider compensating controls for exposed systems while remediation is scheduled and verified. Security teams should also review asset inventory for affected product deployments and assign an owner for follow-up. Security teams should also review relevant monitoring, detection, and logs for exposed assets that need extra review. Security teams should also track exceptions, retest remediated assets, and close the item only after evidence is documented. Security teams should also consider compensating controls for exposed and

Technical summary

The imagecli library's `scale <ratio>` pipeline operation is vulnerable to a remote crash due to lack of upper-bound validation on the CLI-supplied ratio. This can be exploited by a single request, causing an attempted allocation of hundreds of terabytes and aborting the process. Affected product deployments should be identified, and owners assigned for follow-up. Official advisories or CVE records should be reviewed to validate affected scope, severity, and vendor guidance.

Defensive priority

Remote crash vulnerability in imagecli library

Recommended defensive actions

• Verify imagecli library version and apply patch if available
• Restrict user-controlled pipeline strings to prevent remote crashes
• Monitor for similar vulnerabilities in other libraries
• Review official advisories or CVE records to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record indicates a remote crash vulnerability in imagecli's `scale <ratio>` pipeline operation due to lack of upper-bound validation on the CLI-supplied ratio. The NVD entry is currently 7.5 HIGH. A large ratio (e.g., 100000) causes an attempted allocation of hundreds of terabytes, aborting the process. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources