Vulnerability Reportrust:1.97.0-bookworm

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. An attacker could achieve remote code execution or heap overflow by processing specially crafted OpenEXR files (CVE-2023-5841) or trigger a buffer overflow via GD image parsing (CVE-2009-3546). While the image is an official, pinned-by-digest build with low-severity post-exploit findings (max 4.69), the large exposed surface (2391 total) demands remediation before release. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.