The raster crate for Rust contains a vulnerability in its crop function located in src/editor.rs. While the crop width and height parameters are properly clamped against the source image dimensions, the offset_x and offset_y parameters are only clamped against zero and not against the maximum source width or height. This can lead to an integer underflow condition (CWE-191) when offset values exceed source dimensions, potentially causing a denial of service or application crash. The CVSS v3.1 score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability.

The vulnerability can cause an integer underflow leading to a denial of service (application crash or instability) when the crop function is called with offset parameters exceeding source dimensions. There is no reported impact on confidentiality or integrity. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted input for offset_x and offset_y parameters in the crop function to prevent triggering the integer underflow.