The vulnerability exists in imagecli's scale <ratio> pipeline operation (Scale::apply() in src/image_ops.rs). The output dimensions are calculated by multiplying the input dimension by the user-supplied ratio parsed as a float without range checks. A large ratio, such as 100000, causes an attempt to allocate hundreds of terabytes of memory, which aborts the process. This uncontrolled memory allocation (CWE-789) can be triggered remotely if the application embeds imagecli and accepts user-controlled pipeline strings, resulting in a denial of service via process crash.

An attacker can cause a denial of service by crashing the application or service embedding imagecli through supplying a large scale ratio that triggers excessive memory allocation. There is no impact on confidentiality or integrity reported, only availability is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing untrusted user input directly to the scale ratio parameter in imagecli or any application embedding it. Implement input validation to restrict the scale ratio to a safe upper bound to prevent excessive memory allocation.