The vulnerability in imagecli's Scale::apply function (src/image_ops.rs) involves computing output dimensions by multiplying a dimension by a ratio parsed from user input without any range checks. The ratio is parsed using nom::number::complete::float but lacks validation on its value, leading to uncontrolled memory allocation (CWE-789). This can cause remote denial of service by crashing applications embedding imagecli that accept user-controlled pipeline strings.

The vulnerability can cause a denial of service by crashing the affected application remotely. There is no impact on confidentiality or integrity reported. The CVSS score of 7.5 reflects a high severity denial of service vulnerability exploitable remotely without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications embedding imagecli should avoid processing untrusted user-controlled pipeline strings or implement input validation to restrict the ratio parameter to safe bounds.