CVE-2026-71202 affects the raster Rust crate's crop() function in src/editor.rs. The function correctly clamps crop width and height against source image dimensions but fails to clamp offset_x and offset_y against the source width and height. When an offset value exceeds the corresponding source dimension, an integer underflow occurs as width2 - offset_x produces a negative i32 value. In Rust release builds, this arithmetic does not trigger a panic at the subtraction point. The negative i32 is subsequently cast to a usize value and passed to Vec::with_capacity() inside Image::blank(), causing a capacity-overflow panic that crashes the process. A single crafted crop request is sufficient to trigger the denial-of-service condition, making this a remotely exploitable crash vulnerability in any application using the raster crate for image processing.